Rewriting, Computation and Proof

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris ...

Author: Hubert Comon-Lundh | Claude Kirchner | Hélène Kirchner

56 downloads 1998 Views 3MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen

Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen University of Dortmund, Germany Madhu Sudan Massachusetts Institute of Technology, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Moshe Y. Vardi Rice University, Houston, TX, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany

4600

Hubert Comon-Lundh Claude Kirchner Hélène Kirchner (Eds.)

Rewriting Computation and Proof Essays Dedicated to Jean-Pierre Jouannaud on the Occasion of His 60th Birthday

13

Volume Editors Hubert Comon-Lundh Ecole Normale Supérieure de Cachan Laboratoire Spécification et Vérification CNRS UMR 8643, 61, avenue du Président Wilson, 94235 Cachan Cedex, France E-mail: [email protected] Claude Kirchner INRIA & LORIA 615, rue du Jardin Botanique, 54602 Villers-lès-Nancy Cedex, France E-mail: [email protected] Hélène Kirchner CNRS & INRIA, LORIA Campus Scientifique, BP 239, 54506 Vandœuvre-lès-Nancy, France E-mail: [email protected]

Library of Congress Control Number: 2007928575 CR Subject Classification (1998): F.3.1-2, F.4, D.1.6, D.3, I.1, I.2.2-3 LNCS Sublibrary: SL 1 – Theoretical Computer Science and General Issues ISSN ISBN-10 ISBN-13

0302-9743 3-540-73146-6 Springer Berlin Heidelberg New York 978-3-540-73146-7 Springer Berlin Heidelberg New York

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. Springer is a part of Springer Science+Business Media springer.com © Springer-Verlag Berlin Heidelberg 2007 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12078622 06/3180 543210

VI

Preface

Preface

This volume is dedicated to Jean-Pierre Jouannaud on his 60th birthday. It contains refereed contributions by leading researchers in the diﬀerent areas spanned by Jean-Pierre Jouannaud’s work. These papers were presented at the symposium held in Cachan near Paris, on June 21–22, 2007, in Jean-Pierre Jouannaud’s honor. Jean-Pierre has deeply inﬂuenced, and is still inﬂuencing, research in Informatics, through the many important results he has produced in various research ﬁelds, through the generations of scholars he has educated, and through the role he has played in helping the Informatics discipline to reach maturity and its place among the other disciplines.

Jean-Pierre’s Origins and Contributions Jean-Pierre defended his ﬁrst thesis in 1972 on “Filtres digitaux autoadaptifs : algorithmes de calcul et simulation”. Together with the emergence of Informatics, he then moved to more symbolic topics and, as assistant professor at the university of Paris 6 in Jussieu, he defended his “th´ese d’´etat” in 1977 entitled “Sur l’inf´erence et la synth`ese automatiques de fonctions LISP `a partir d’exemples”. This led him to investigate the foundational concepts emerging at that time: lambda-calculus and rewriting. Jean-Pierre then played a leading role in rewriting and its technology: he introduced this ﬁeld in Nancy, when he took up an Associate Professor position in 1979, and founded there, together with Pierre Lescanne, the Eureca team that got the CNRS silver medal in 1986. He was also at the origin of the RTA (Rewriting Techniques and Applications) conference series in 1985. In this domain Jean-Pierre’s major contributions spanned to uniﬁcation, rewriting and completion modulo, conditional rewriting, termination proofs, modular properties, and automated proofs by induction in rewrite theories. During his one year sabbatical at SRI International in 1984–85, Jean-Pierre Jouannaud developed further his strong interest for algebraic speciﬁcation languages and their eﬃcient implementation. He contributed with Kokichi Futatsugi, Joseph Goguen and Jos´e Meseguer to the design, semantics and implementation of OBJ2. Further important contributions of Jean-Pierre Jouannaud concern order-sorted algebras and more recently membership equational logic, an essential feature of the Maude system. In 1985, Jean-Pierre moved to the university of Paris Sud in Orsay, where he became full professor in 1986. There he founded the Demons team, which focused on automated deduction and constraint solving. Then, with interactions in particular with G´erard Huet, his interests widened to higher-order rewriting and the calculus of constructions. He contributed to strong results on the in-

VIII

Preface

tegration of rewriting and deduction leading to the design of proof assistants with rewriting as a ﬁrst-class concept. His results on termination of higher-order rewriting are also leading the way. In recognition of these outstanding scientiﬁc achievements, he was awarded the “Prix Montpetit” from the French Academy of Sciences in 2000. Jean-Pierre started several international collaborations and forged scientiﬁc links and friendships, which continue over the years, in particular in the USA, Canada, Argentina, Spain, Japan and Taiwan. The outcomes were formal joint research projects (especially through NSF grants and European working groups), general collaboration agreements, such as the French-Taiwanese collaboration, which has been awarded a “Grand Prix” from the French Academy of Science, or simply intensive visits both ways. To promote and animate the theoretical computer science community has been and remains one of his concerns. He was a member of the CNU (National University Council), a member of the CNRS national committee, and he is heading with great success the computer science laboratory at Ecole Polytechnique. Jean-Pierre has exceptional qualities as a research team manager and as a supervisor of students. His work with his students has always involved a close, friendly relationship, a daily meeting, weekly encouragements, monthly entertainment and a close care of the future of the students. One of the keys of Jean-Pierre Jouannaud as a research team manager is his motto: “enjoy!”. Enjoy everything that is good, which includes working together on research problems, and also drinking good wine, eating good food, skiing, climbing, windsurﬁng,. . . The best being to combine several of these activities. Having fun working together, it is easy to spend hours on a problem, to launch new projects, to arouse enthusiasm among students.

Jean-Pierre Jouannaud’s Doctoral Descendants Jean-Pierre is an excellent teacher. He not only knows how to motivate work on diﬃcult and rich concepts, but he has also a profound understanding of their deep properties and relationships. He loves to communicate his knowledge, knowhow and real enthusiasm. He has lectured generations of students and liked to be involved in doctoral teaching. His ideas and practice have strongly inﬂuenced many PhD students. The following table summarizes his doctoral descendants. We have tried to be as exhaustive as possible, and we did not take into account the many students that will defend after 2007. A few persons appear several time, as they have been supervised by two people. 1. Jean-Pierre Treuil, 1978: LQAS : Un syst´eme question-r´eponse qui acquiert ses connaissances par apprentissage; 2. Fernand Reining, 1981: L’Ordre de D´ecomposition : un Outil Incr´emental pour Prouver la Terminaison Finie des Syst´emes de R´e´ecriture ´equationnels;

Preface

IX

3. Jean-Luc R´emy, 1982: Etude des syst`emes de R´e´ecriture Conditionnels et Applications aux Types Abstraits Alg´ebriques; (a) Hantao Zhang, 1984: REVEUR4 : Etude et mise en æuvre de la r´e´ecriture conditionnelle; (b) Wadoud Bousdira, 1990: Etude des Propri´et´es des Syst`emes de R´e´ecriture Conditionnelle. Mise en Oeuvre d’un Algorithme de Compl´etion; 4. Claude Kirchner, 1982: R´esolution d’´equations dans les alg`ebres libres et les vari´et´es ´equationnelles d’alg`ebres; (a) Jalel Mzali, 1986: M´ethodes de ﬁltrage ´equationnel et de preuve automatique de th´eor`emes; (b) Pierre R´ety, 1988: M´ethodes d’uniﬁcation par surr´eduction; i. Jacques Chabin, 1994: Uniﬁcation g´en´erale par surr´eduction ordonn´ee contrainte et surr´eduction dirig´ee; ii. S´ebastien Limet, 1996: Uniﬁcation dans la programmation logico´equationnelle; A. Pierre Pillot, 2007: Utilisation des langages d’arbres pour la mod´elisation et la v´eriﬁcation de syst`emes ` a ´etats inﬁnis; iii. Julie Vuotto, 2004: Langages d’arbres r´eguliers et alg´ebriques pour la r´e´ecriture et la v´eriﬁcation; (c) Aristide M´egrelis, 1990: Alg`ebre galactique — Un proc´ed´e de calcul formel ; ´ (d) Eric Domenjoud, 1991: Outils pour la d´eduction automatique dans les th´eories associatives-commutatives; (e) Mohamed Adi, 1991: Calculs associatif et commutatifs. Etude et r´ealisation du syst`eme UNIFAC ; (f) Patrick Viry, 1992: La r´e´ecriture concurrente; (g) Francis Klay, 1992: Uniﬁcation dans les Th´eories Syntaxiques; i. Karim Berkanu, 2003: Un cadre m´ethodologique pour l’int´egration de services par ´evitement des interactions; ii. St´ephanie Delaune, 2006: V´eriﬁcation des protocoles cryptographiques et propri´et´es alg´ebriques; (h) Marian Vittek, 1994: ELAN : Un cadre logique pour le prototypage de langages de programmation avec contraintes; (i) Pauline Strogova, 1996: Techniques de R´e´ecriture pour le Traitement de Probl`eme de Routage dans des Graphes de Cayley; ´ (j) Ili`es Alouini, : Etude et mise en oeuvre de la r´e´ecriture conditionnelle concurrente sur des machines parall`eles a ` m´emoire distribu´ee; (k) Farid Ajili, 1998: Contraintes Diophantiennes Lin´eaires : r´esolution et coop´eration inter-r´esolveurs; (l) Carlos Castro, 1998: Une approche d´eductive de la r´esolution de probl`emes de satisfaction de contraintes; (m) Christelle Scharﬀ, 1999: D´eduction avec contraintes et simpliﬁcation dans les th´eories ´equationnelles; (n) Horatiu Cirstea, 2000: Calcul de r´e´ecriture : fondements et applications;

X

Preface

i. Clara Bertolissi, 2005: The graph rewriting calculus : properties and expressive capabilities; ii. Germain Faure, 2007: Structures et mod`eles du calcul de r´e´ecriture; (o) Eric Deplagne, 2002: Syst`eme de preuve modulo r`ecurrence ; (p) Huy Nguyen, 2002: Calcul de r´e´ecriture et automatisation du raisonnement dans les assistants de preuve; (q) Clara Bertolissi, 2005: The graph rewriting calculus : properties and expressive capabilities; (r) Benjamin Wack, 2005: Typage et d´eduction dans le calcul de r´e´ecriture; (s) Antoine Reilles, 2006: R´e´ecriture et compilation de conﬁance; (t) Fabrice Nahon, 2007: Preuves par induction dans le calcul des s´equents modulo; (u) Germain Faure, 2007: Structures et mod`eles du calcul de r´e´ecriture; (v) Florent Garnier, 2007: Terminaison en temps moyen ﬁni de syst`emes de r`egles probabilistes; (w) Colin Riba, 2007: D´eﬁnitions par r´e´ecriture dans le lambda-calcul: conﬂuence, r´eductibilit´e et typage; 5. H´el`ene Kirchner, 1982: R´esolution d’´equations dans les alg`ebres libres et les vari´et´es ´equationnelles d’alg`ebres; (a) Christophe Ringeissen, 1993: Combinaison de R´esolutions de Contraintes; (b) Claus Hintermeier, 1995: D´eduction avec sortes ordonn´ees et ´egalit´es; (c) Thomas Genet, 1998: Contraintes d’ordre et automates d’arbres pour les preuves de terminaison; i. Val´erie Viet Triem Tong, 2003: Automates d’arbres et r´e´ecriture pour l’´etude de probl`emes d’accessibilit´e ; (d) Peter Borovansk´ y, 1998: Le contrˆ ole de la r´e´ecriture: ´etude et implantation d’un formalisme de strat´egies; (e) Pierre-Etienne Moreau, 1999: Compilation de r`egles de r´e´ecriture et de strat´egies non-d´eterministes; i. Antoine Reilles, 2006: R´e´ecriture et compilation de conﬁance; (f) Hubert Dubois, 2001: Syst`emes de r`egles de production et calcul de r´e´ecriture; (g) Quang-Huy Nguyen, 2002: Calcul de r´e´ecriture et automatisation du raisonnement dans les assistants de preuves; (h) Olivier Fissore, 2003: Terminaison de la r´e´ecriture sous strat´egies; (i) Liliana-Mariana Ibanescu, 2004: Programmation par r`egles et strat´egies pour la g´en´eration automatique de m´ecanismes de combustion d’hydrocarbures polycycliques; (j) Duc Khanh Tran, 2006: Conception de proc´edures de d´ecision par combinaison et saturation; 6. Kounalis, 1985: Validation de sp´eciﬁcations alg´ebriques par compl´etion inductive; (a) Pascal Urso, 2002: G´en´eralisations et m´ethodes correctes pour l’induction math´ematique;

Preface

XI

(b) Ponsini Olivier, 2005: Des programmes imp´eratifs vers la logique ´equationnelle pour la v´eriﬁcation; 7. Michael Rusinowitch, 1987; partial: D´emonstration automatique par des techniques de r´e´ecriture (th´ese d’´etat); (a) Adel Bouhoula, 1994: Preuves automatiques par r´ecurrence dans les th´eories conditionnelles; (b) Laurent Vigneron, 1994: D´eduction automatique avec contraintes symboliques dans les th´eories ´equationnelles; (c) Eric Monfroy, 1996: Collaboration de solveurs pour la programmation par contraintes; i. Lucas Bordeaux, 2003: R´esolution de probl´emes combinatoires mod´elis´es par des contraintes quantiﬁ´ees; ii. Brice Pajot, 2006: Mod`eles et architectures pour la r´esolution coop´erative par solveurs de contraintes; iii. Tony Lambert, 2006: Hybridation de m´ethodes compl`etes et incompl`etes pour la r´esolution de CSP; (d) Narjes Berregeb, 1997: Preuves par induction implicite : cas des th´eories associatives-commutatives et observationnelles; (e) Sorin Stratulat, 2000: Preuves par r´ecurrence avec ensembles couvrants contextuels. Application a ` la v´eriﬁcation de logiciels de t´el´ecommunications; (f) Silvio Ranise, 2002: On the Integration of Decision Procedures in Automated Deduction; (g) Matthieu Turuani, 2003: S´ecurit´e des Protocoles Cryptographiques: D´ecidabilit´e et Complexit´e ; (h) Julien Musset, 2003: Approximation of transition relations. Application to inﬁnite states systems veriﬁcation; (i) Yannick Chevalier, 2003: R´esolution de probl`emes d’accessibilit´e pour la compilation et la validation de protocoles cryptographiques; (j) Tarek Abbes, 2004: Classiﬁcation du traﬁc et optimisation des r`egles de ﬁltrage pour la d´etection d’intrusions; (k) Abdessamad Imine, 2006: Conception Formelle d’Algorithmes de R´eplication Optimiste. Vers l’Edition Collaborative dans les R´eseaux Pair-` a-Pair ; (l) Eugen Zalinescu, 2007: S´ecurit´e des protocoles cryptographiques: d´ecidabilit´e et r´esultats de transfert ; 8. Hubert Comon, 1988; unoﬃcial: Uniﬁcation et disuniﬁcation. Th´eories et applications; (a) Marianne Haberstrau, 1993: ECOLOG : un Environnement pour la programmation en LOGique COntrainte; (b) Florent Jacquemard, 1996: automates d’arbres et r´e´ecriture de termes; (c) Yan Jurski, 1999: Expression de la relation binaire d’accessibilit´e pour les automates ` a compteurs plats et les automates temporis´es;

XII

9. 10. 11. 12.

13. 14.

15. 16.

17. 18. 19.

Preface

(d) V´eronique Cortier, 2003: V´eriﬁcation automatique des protocoles cryptographiques; i. Eugen Zalinescu, 2007: S´ecurit´e des protocoles cryptographiques: d´ecidabilit´e et r´esultats de transfert ; (e) Vincent Bernat, 2006: Th´eories de l’intrus pour la v´eriﬁcation des protocoles cryptographiques; (f) St´ephanie Delaune, 2006: V´eriﬁcation des protocoles cryptographiques et propri´et´es alg´ebriques; Alexandre Boudet, 1990: Uniﬁcation dans les m´elanges de th´eories ´equationelles; Herv´e Devie, 1991: Une approche alg´ebrique de la r´e´ecriture de preuves ´equationnelles et son application a ` la d´erivation de proc´edures de compl´etion; Evelyne Contejean, 1992: El´ements pour la d´ecidabilit´e de l’uniﬁcation modulo la distributivit´e ; Maribel Fernandez, 1993: Mod`eles de calculs multiparadigmes fond´es sur la r´e´ecriture; (a) Lionel Khalil, 2003: G´en´eralisation des r´eseaux d’interaction avec l’agent amb de McCarthy : propri´et´es et applications; (b) Fran¸cois-R´egis Sinot, 2006: Strat´egies eﬃcaces et mod`eles d’implantation pour les langages fontionnels; Marianne Haberstrau, 1993: ECOLOG : un Environnement pour la programmation en LOGique COntrainte; Claude March´e, 1993: R´e´ecriture modulo une th´eorie pr´esent´ee par un syst`eme convergent et d´ecidabilit´e des probl`emes du mot dans certaines classes de th`eories ´equationnelles; (a) Xavier Urbain, 2001: Approche incr´ementale des preuves automatiques de terminaison; (b) Pierre Corbineau, 2005: D´emonstration Automatique en Th´eorie des Types; Walid Sadﬁ, 1993: Contribution a ` l’´etude de la s´equentialit´e forte des d´eﬁnitions de fonctions par r`egles; Fr´ed´eric Blanqui, 2001: Th´eorie des Types et R´ecriture; (a) Colin Riba, 2007: D´eﬁnitions par r´e´ecriture dans le lambda-calcul: conﬂuence, r´eductibilit´e et typage; Benjamin Monate, 2002: Propri´et´es uniformes de familles de syst`emes de r´e´ecriture de mots param´etr´ees par des entiers; Daria Walukiewicz-Chrzaszcz, 2003: Termination of Rewriting in the Calcu lus of Constructions; 2004: Modules in Type Theory with Generative Deﬁnitions; Jacek Chrzaszcz,

We feel privileged to edit this volume, as a way to thank Jean-Pierre Jouannaud for all his scientiﬁc contributions and for communicating to us his enthusiasm for research. We are most grateful to all the authors who enthusiastically contributed to this special issue and participated in the symposium. We are also thankful to all those who helped us in the refereeing process and to

Preface

XIII

Alfred Hofmann at Springer who supported our initiative. CNRS, Ecole Normale Sup´erieure de Cachan, INRIA and LSV are gratefully acknowledged for their organizational and ﬁnancial support. April 2007

Hubert Comon-Lundh Claude Kirchner H´el´ene Kirchner

Organization

Referees Fr´ed´eric Blanqui Olivier Bournez Paul Brauner Yannick Chevalier Nachum Dershowitz Gilles Dowek Bernhard Gramlich

Emmanuel Hainry Claude March´e Stephan Merz Fran¸cois Lamarche Yohishito Toyama Femke van Raamsdonk

Table of Contents

Rewriting Foundations The Hydra Battle Revisited . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nachum Dershowitz and Georg Moser

1

Orderings and Constraints: Theory and Practice of Proving Termination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cristina Borralleras and Albert Rubio

28

Narrowing, Abstraction and Constraints for Proving Properties of Reduction Relations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Isabelle Gnaedig and H´el`ene Kirchner

44

Computability Closure: Ten Years Later . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fr´ed´eric Blanqui

68

Reduction Strategies and Acyclicity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jan Willem Klop, Vincent van Oostrom, and Femke van Raamsdonk

89

Proof and Computation Towards Rewriting in Coq . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . and Daria Walukiewicz-Chrzaszcz Jacek Chrzaszcz,

113

Superdeduction at Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Paul Brauner, Cl´ement Houtmann, and Claude Kirchner

132

Remarks on Semantic Completeness for Proof-Terms with Laird’s Dual Aﬃne/Intuitionistic λ-Calculus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mitsuhiro Okada and Ryo Takemura

167

Linear Recursive Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sandra Alves, Maribel Fern´ andez, M´ ario Florido, and Ian Mackie

182

Towards Safety and Security Deducibility Constraints, Equational Theory and Electronic Money . . . . . Sergiu Bursuc, Hubert Comon-Lundh, and St´ephanie Delaune

196

Applying a Theorem Prover to the Veriﬁcation of Optimistic Replication Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Abdessamad Imine and Micha¨el Rusinowitch

213

XVI

Table of Contents

Towards Modular Algebraic Speciﬁcations for Pointer Programs: A Case Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Claude March´e

235

Modeling Permutations in Coq for Coccinelle . . . . . . . . . . . . . . . . . . . . . Evelyne Contejean

259

PhD Descendance Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

271

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

273

The Hydra Battle Revisited Nachum Dershowitz1,2 and Georg Moser3 1

3

School of Computer Science, Tel Aviv University, 69978 Ramat Aviv, Israel [email protected] 2 Microsoft Research, Redmond, WA 98052 Institute of Computer Science, University of Innsbruck, Technikerstrasse 21a, A-6020 Innsbruck, Austria [email protected]

To Jean-Pierre on this momentous occasion.

Abstract. Showing termination of the Battle of Hercules and Hydra is a challenge. We present the battle both as a rewrite system and as an arithmetic while program, provide proofs of their termination, and recall why their termination cannot be proved within Peano arithmetic.

As a second labour he ordered him to kill the Lernaean hydra. That creature, bred in the swamp of Lerna, used to go forth into the plain and ravage both the cattle and the country. Now the hydra had a huge body, with nine heads, eight mortal, but the middle one immortal. . . . By pelting it with ﬁery shafts he forced it to come out, and in the act of doing so he seized and held it fast. But the hydra wound itself about one of his feet and clung to him. Nor could he eﬀect anything by smashing its heads with his club, for as fast as one head was smashed there grew up two. – Pausanias, Description of Greece, 2.37.4

1

Introduction

The Battle of Hydra and Hercules, as described in the above-quoted myth, and depicted on the Etruscan hydra (water jar) in Fig. 1, inspired Laurie Kirby and Jeﬀ Paris [24] to formulate a process, the termination of which cannot be proved by ordinary induction on the natural numbers. Instead, recourse must be made to induction on the ordinals less than the ordinal number “epsilon naught”, in the ordinal hierarchy created by Georg Cantor.

The ﬁrst author’s research was supported in part by the Israel Science Foundation (grant no. 250/05).

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 1–27, 2007. c Springer-Verlag Berlin Heidelberg 2007

2

N. Dershowitz and G. Moser

Fig. 1. Caeretan hydra, attributed to Eagle Painter, c. 525 b.c.e. See [19]. (Courtesy of the J. Paul Getty Museum, Villa Collection, Malibu, CA). 1

The alternating steps of Hercules and Hydra in the formal battle are quite easy to understand (and are more appealing than the similar but older Goodstein sequence [17], also treated in [24]). The battle itself is described in Sect. 2. Yet the fact that Hercules is always the declared winner, as shown in Sect. 4, is far from obvious. As such, it is arguably the simplest example of a terminating 1

Not to be reproduced without written permission from the J. paul Getty Museum.

The Hydra Battle Revisited

3

process that is not amenable to argument by means of Peano’s famous axioms of arithmetic. Termination is a conceptually clear notion. Thus, it is fair to claim that the Hydra Battle is more intuitive, as an independence result, than employing Ramsey-like theorems, for instance; cf. [30]. In the popular survey on rewriting [10]2 by Jean-Pierre Jouannaud and the ﬁrst author (and in several later publications, [11, Prob. 23], [7]), a rewrite system for the battle was presented, but it was unfortunately fraught with lapsus calami. Nevertheless, proving its termination has been a challenge for contestants in termination competitions [28]. A repaired version was promulgated years later [26]. In the sections that follow, we describe the vicissitudes of this formalization of the battle in rewrite systems (Sect. 5), prove their termination (Sect. 8), and also encode the battle as a while program (Sect. 9). This paper concentrates on the interpretation of successive hydræ as decreasing ordinal numbers. But there are alternative, less “highbrow” arguments (in Alan Turing’s words [35]); see Martin Gardner’s column [15]. Some properties of ordinals and orders are brieﬂy reviewed in Sects. 3, 6 and 7. For more on the problem and its extensions, see [13]. See also [27,21,34]. We conclude with one such extension.

2

The Hydra Battle

In a landmark paper [24], Kirby and Paris showed that – for their version of the battle – more than ordinary induction on the natural numbers is needed to show that Hercules prevails. 2.1

The Formal Battle

In the mathematical battle, hydræ are represented as (unordered, rooted, ﬁnite) trees, with each leaf corresponding to one head of the monster. Whereas Hercules decapitates Hydra, one head at a time, Hydra regenerates according to the following rule: If the severed head has a grandparent node, then the branch issuing from that node together with the mutilated subtree is multiplied by a certain factor; otherwise, Hydra suﬀers the loss without any regrowth. Hercules wins when (not if!) the beast is reduced to the empty tree. (In the original formulation of this game, the multiplication factor is one more than the stage of the game. We modify the deﬁnition slightly and set the multiplication factor equal to the stage of the game, as otherwise the system D below fails to encode the Hydra Battle. The results in [24] are unaﬀected by this change.) We write (H, n) to describe a single conﬁguration in the game, where H denotes Hydra and n the current stage of the game. 2

This survey is the most cited document for its year of publication (1990) in the CiteSeer database [31], and has always been high in the overall list.

4

N. Dershowitz and G. Moser

Example 1.

(H1 , 1)

(H2 , 2)

(H3 , 3)

In the ﬁrst stage, Hercules chops oﬀ the leftmost head. As this head has no grandparent, Hydra shrinks. However, in Stage 2, Hercules chops oﬀ a head with a grandparent (the triangular root). Consequently, Hydra grows two replacement branches, as indicated. More examples can be found in [24,34]. 2.2

Functional Hydra

It is easy to express the Hydra Battle in a functional language with list operations, like Lisp. However, so as not to complicate matters unnecessarily, we do not follow the original deﬁnition of Kirby and Paris, but rather restrict attention to ordered trees (with immediate subtrees ordered sequentially from left to right). Let nil denote an empty list and cons(x, y) be the list obtained by prepending an element x (the right-most subtree) to a list y (the remaining tree). Thus, the ﬁrst hydra in Example 1 would be represented as follows: cons(, cons(cons(cons(, cons(, nil)), nil), cons(, cons(, cons(, nil))))) , where = cons(nil, nil) stands for a leaf of a Hydra and we have reordered the immediate subtrees of the root of H1 such that the number of nodes is nonincreasing. In the rewrite system to be introduced below, a “cons-cell” is grafted together by the function symbol g. Let car(cons(x, y)) = x and cdr(cons(x, y)) = y extract the ﬁrst item in a nonempty list cons(x, y) and the remainder of the list, respectively. The battle can be encoded by the following program, L: h0 (x) where

nil x = nil hn+1 (dn (x)) otherwise ⎧ car(x) = nil ⎨ cdr(x) car(car(x)) = nil dn (x) := fn (cdr(car(x)), cdr(x)) ⎩ cons(dn (car(x)), cdr(x)) otherwise x n=0 fn (y, x) := cons(y, fn−1 (y, x)) otherwise hn (x)

:=

The Hydra Battle Revisited

5

Here, hn (x) plays the game with initial hydra x, starting at stage n, dn (x) plays one round of the battle, by travelling along a leftmost branch until encountering a branch z such that car(car(z)) is empty, and then using fn (y, x) to prepend k copies of y = cdr(car(z)) to x. Better yet, if we let ε symbolize nil and use a colon : for cons, then the following pattern-directed program plays the battle h0 (x) until its inevitable end: hn (ε) := ε hn (x : y) := hn+1 (dn (x : y)) dn (ε : y) := y dn ((ε : x) : y) := fn (x, y) dn (((u : v) : x) : y) := dn ((u : v) : x) : y f0 (y, x) := x fn+1 (y, x) := y : fn (y, x)

3

Orders and Ordinals

Termination proofs are often based on well-founded orderings. Our proofs are no exception. 3.1

Well-Founded Orders

A partial order is an irreﬂexive and transitive binary relation. Its converse is written with a reﬂected symbol ≺. A quasi-order is a reﬂexive and transitive relation. A quasi-order induces a (strict) partial order , such that a b if a b a. A partial order on a set A is well-founded (on A) if there exists no inﬁnite descending sequence a1 a2 · · · of elements of A. A partial order is linear (or total ) on A if for all a, b ∈ A, a diﬀerent from b, a and b are comparable by . A linear well-founded order is called a well-order. Let F be a signature. An F -algebra A is a set A, its domain, together with operations fA : An → A for each function symbol f ∈ F of arity n. An F algebra (A, ≺) is called monotone if A is associated with a partial order and every algebra operation fA is strictly monotone in all its arguments. A monotone F -algebra (A, ) is called well-founded if is well-founded. Let (A, ) denote an F -algebra and let a : V → A denote an assignment. We write [a]A to denote the homeomorphic extension of the assignment a and deﬁne an ordering A on terms T (F , V) in the usual way: s A t if [a]A (s) [a]A (t) for every assignment a. 3.2

Order Types

We assume some very basic knowledge of set theory and in particular of ordinals, as in, for example, [22]. We write > to denote the well-order on ordinals. This order can, of course, be employed for inductive arguments.

6

N. Dershowitz and G. Moser

The ordinal 0 (“epsilon naught”) is the smallest solution to ω x = x. Recall that any ordinal α < 0 , α = 0, can be uniquely represented in Cantor Normal Form (CNF) as a sum ω α1 + · · · + ω αn , where α1 · · · αn . The set of ordinals below 0 in CNF will also be denoted CNF. For α = ω α1 + · · · + ω αn and β = ω αn+1 + · · · + ω αn+m , the natural sum α ⊕ β is deﬁned as ω απ(1) + · · · + ω απ(n+m) , where π denotes a permutation of the indices [1, n + m] (= {1, . . . , n + m}) such that απ(1) απ(2) · · · απ(n+m) is guaranteed. We write α · n as an abbreviation for α + · · · + α (n times α), and we identify the natural numbers (N) with the ordinals below ω. We denote the set of limit ordinals by Lim. To each well-founded order on a set A, one can associate a (set-theoretic) ordinal, its order type. First, we associate an ordinal to each element a of A by setting otype (a) := sup{otype (b) + 1 | b ∈ A and a b} . Then the order type of , denoted otype(), is deﬁned as sup{otype (a) + 1 | a ∈ A}. For two partial orders and on A and A , respectively, a mapping o : A → A embeds into if, for all x, y ∈ A, we have that x y implies o(x) o(y). Lemma 1. If both and are well founded and if can be embedded into , then otype() otype( ). Two linear partial orders (A, ) and (B, ) are order-isomorphic (or equivalent ) if there exists a surjective mapping o : A → B such that (x y ⇐⇒ o(x) o(y)) for all x, y ∈ A.

4

Herculean Strength

The natural game-theoretic question is whether Hercules has a winning strategy. A strategy is a mapping determining which head Hercules should chop oﬀ at each stage. 4.1

Hercules Prevails

It turns out that whatever strategy Hercules ﬁghts by he eventually wins. It’s only a question of time. In our proof, we follow Kirby and Paris [24] and associate with each hydra an ordinal below 0 : 1. Assign 0 to each leaf. 2. Assign ω α1 ⊕ · · · ⊕ ω αn to each internal node, where αi are the ordinals assigned to the children of the node. The ordinal representing Hydra is the ordinal assigned to her root node.

The Hydra Battle Revisited

7

Example 2. Consider hydræ H1 –H3 , above. These have the representations ω 3 ⊕ ω 2 ⊕ 1, ω 3 ⊕ ω 2 , and ω 2 · 3, respectively. In the sequel, we confound the representation of a hydra as ﬁnite tree and as ordinal. Let (H, n) denote a conﬁguration of the game. Then (H)Sn denotes the resulting Hydra if strategy S is applied to H at stage n. That is, the next conﬁguration is ((H)Sn , n + 1). Lemma 2 (Kirby & Paris [24]). For any strategy S, Hydra H and natural number n, we obtain H > (H)Sn . Theorem 1 (Kirby & Paris [24]). Every strategy is a winning strategy. Proof. The theorem follows from the lemma together with the fact that > is well-founded. One can readily see from the proof that Hercules also wins a seemingly more challenging battle, wherein Hydra generates an arbitrary number of replacement branches at any level of the tree, but the resulting Hydra is smaller (as an ordinal) than the original. Again, any strategy is a winning strategy. Such a reformulation of the Hydra Battle is depicted in Fig. 2, taken from a survey lecture on proofs and computation by Jouannaud [23].3 Similar extensions of the Hydra Battle have recently been considered by Rudolf Fleischer in [13].

=⇒

Fig. 2. Evelyne Contejean’s rendition of the battle (from Jouannaud’s survey [23])

Now we formally deﬁne a speciﬁc strategy for the Hydra Battle that has been called standard in [34]. For n ∈ N, we associate an ordinal αn ∈ CNF with every α ∈ CNF: ⎧ 0 if α = 0 ⎪ ⎪ ⎪ ⎨β if α = β + 1 αn = γ ⎪ β + ω · n if α = β + ω γ+1 ⎪ ⎪ ⎩ γn β+ω if α = β + ω γ and γ ∈ Lim 3

“This is one of Nachum Dershowitz’s favorite examples” [23].

8

N. Dershowitz and G. Moser

Then we can deﬁne the standard Hydra Battle as follows: Deﬁnition 1 (Hydra Battle). A hydra is an ordinal in CNF. The Hydra Battle is a sequence of conﬁgurations. A conﬁguration is a pair (α, n), where α denotes a hydra and n 1, the current step. Let (α, n) be a conﬁguration, such that α > 0. Then the next conﬁguration in the standard strategy is (αn , n + 1). This deﬁnition implies that we force a one-to-one correspondence between ﬁnite trees and ordinals. Hence, we again restrict ourselves to ordered trees. This strategy conforms with the prior description of the battle, provided Hydra’s immediate subtrees in the functional battle are arranged (at all levels) from the largest on the left to the smallest on the right. Here, largeness or smallness of subtrees is measured by the corresponding ordinal. Remark 1. The sequence (αn )n∈N is usually referred to as a fundamental sequence of α. A fundamental sequence fulﬁlls the property that for limit ordinal λ ∈ Lim, the sequence (λn )n is strictly increasing and its limit is λ. For the connection between rewriting and fundamental sequences, see, for example, [29]. 4.2

Beyond Peano

In the remainder of this section, we show that Peano Arithmetic cannot prove termination of the standard Hydra Battle, which is a special case of a more general theorem stated in [24,13]. We deﬁne two ordinal-indexed hierarchies of number-theoretic functions. Deﬁnition 2 (Hardy [36] and Hydra Functions). The Hardy functions (Hα )α<0 are deﬁned as follows: H0 (n) := n,

and

Hα (n) := Hαn (n + 1) (if α > 0) .

The related Hydra functions (Lα )α<0 , counting the length of the (standard) Hydra Battle, starting stage n with hydra α, are: L0 (n) := 0,

and

Lα (n) := Lαn (n + 1) + 1 (if α > 0) .

The following lemma is an easy consequence of the deﬁnitions: Lemma 3. The hierarchies (Hα )α<0 and (Lα )α<0 form a majorization hierarchy on 0 , in the sense that the functions are strictly increasing and each function at level α eventually dominates the functions at level β for all β < α. Next, we relate the functions Hα and Lα . Lemma 4. For any α < 0 and any n ∈ N we have Hα (n) = HLα (n) (n) = n + Lα (n) .

The Hydra Battle Revisited

9

Proof. The second equation is easily established by noting that, for ﬁnite m, we have Hm (n) = m + n. The ﬁrst equation is proved by induction on α. The case α = 0 follows from L0 (n) = 0. For α > 0, put γ := αn and note that Hα (n) = Hγ (n + 1) = HLγ (n+1) (n + 1) = HLγ (n+1)+1 (n) = HLα (n) (n) . In the second equality, we employ the induction hypothesis. For the third let m = Lγ (n + 1) and observe Hm+1 (n) = Hm (n + 1). A function f is provably recursive in Peano Arithmetic (PA) if there exists a primitive recursive predicate P and a primitive recursive function g such that PA ∀y1 · · · ∀yk ∃xP (y1 , . . . , yk , x) and f satisﬁes f (n1 , . . . , nk ) = g(μx P (n1 , . . . , nk , x)) , where μx denotes the least number operator. Let the Hardy class H be deﬁned as the smallest class of functions (1) containing 0, S (successor), all Hα , for α < 0 , and all projection functions In,i (a1 , . . . , an ) := ai , and (2) closed under primitive recursion and composition. Theorem 2. The Hardy class H is the class of all provably recursive functions in PA. For a proof see [32]. Theorem 3. PA cannot prove termination of the standard Hydra Battle. Proof. Suppose termination of the standard Hydra Battle would be PA-provable. This is equivalent to the fact that PA ∀ α, n ∃m Lα (n) = m , for a suitable arithmetization ·. Hence, for all α < 0 and all n ∈ N: Lα (n) is a provably recursive function in PA. In particular, L(0 )n (n + 1) + 1 is provably recursive, and thus by deﬁnition L0 (n) is provably recursive. (The same holds for L0 (n) + n.) By Lemma 4, we conclude L0 (n) + n = H0 (n), which would imply that H0 (n) is provably recursive, contradicting Theorem 2. Remark 2. It bears mentioning that if Hydra is constrained to a bounded initial height, or if there is a ﬁxed bound on her growth factor [27], then termination is provable in PA.

5

Rewriting Hydra

A (term-) rewriting system is a (ﬁnite) set of rewrite rules, each of which is an ordered pair of terms. Let F denote a signature and V, a (countably inﬁnite) set of variables. The terms over F and V are denoted T (F , V). A binary relation on T (F , V) is a rewrite relation if it is compatible with F -operations and closed

10

N. Dershowitz and G. Moser

under substitutions. The smallest rewrite relation that contains R is denoted →R . The reﬂexive-transitive closure of rewrite steps →R is denoted →∗R ; the transitive closure, →+ R . For further details about rewriting, see the survey by the ﬁrst author and Jouannaud [10] or one of the books [2,33]. In [10], the following rewrite system H was introduced as an encoding of the Hydra Battle:4 h(e(x), y) → h(d(x, y), S(y))

(1)

d(g(0, 0), y) → e(0) d(g(x, y), z) → g(e(x), d(y, z))

(2) (3)

d(g(g(x, y), 0), S(z)) → g(d(g(x, y), S(z)), d(g(x, y), z)) g(e(x), e(y)) → e(g(x, y))

(4) (5)

(To clarify the connection to the standard Hydra Battle, as presented in Sect. 2, we have swapped the original arguments of the symbols d and h and make use of the unary function symbol S instead of the original c.) The idea was for h(x, n) to represent the nth stage of the battle, with Hydra current being x, and with g serving as cons and 0 as nil. Then, d(n, x) marks the position of Hercules’ search for a head to chop oﬀ (n is the replication factor); d was also meant to perform the duplication (which is the rˆ ole of f in the functional program described in Section 2.2). The d in the ﬁrst argument of g on the right side of rule (4) forces that branch to get smaller, via rules (3) and (2), assuming that branch has a head dangling at its right edge. The symbol e is used to signal completion of the operation on a branch, and settles towards the root after replication. The system was designed to allow various sterile derivations, as well as the primary, battle one. Unfortunately, rule (4) does not perform as advertised; the system does not simulate the standard Hydra Battle, as deﬁned in Sect. 2.5 To rectify this, the ﬁrst author proposed (on Pierre Lescanne’s rewriting list [26]) the following System D, comprising six rules: h(e(x), y) → h(d(x, y), S(y)) d(g(0, x), y) → e(x)

(6) (7)

d(g(x, y), z) → g(d(x, z), e(y)) d(g(g(0, x), y), 0) → e(y)

(8) (9)

d(g(g(0, x), y), S(z)) → g(e(x), d(g(g(0, x), y), z)) g(e(x), e(y)) → e(g(x, y)) 4

5

(10) (11)

Some (lost) version of this rewrite system had been presented by the ﬁrst author at the Interdisciplinary Conference on Axiomatic Systems, in Columbus, OH, on December 16, 1988. The originally intended system probably had g(d(g(x, y), S(z)), d(g(g(x, y), 0), z)) as the right-hand side of rule (4). Some additional changes are needed for it to be able to simulate the standard Hydra Battle. We do not discuss this version any further.

The Hydra Battle Revisited

11

We will see below that the underlying semantics of the symbol g changed in the transition from H to D. (Here again we have swapped the arguments of the symbols d and h and make use of the unary function symbol S instead of the original c.) 5.1

Faithfulness

It is not hard to see that, indeed, D faithfully represents the standard Hydra Battle. We deﬁne a mapping O : CN F → T (F , ∅), where F is the set of function symbols in D: ⎧ ⎪ if α = 0 ⎨0 O(α) := g(O(γ), 0) if α = ω γ ⎪ ⎩ g(O(γ), O(β)) if α = β + ω γ Each conﬁguration (α, n) of the game is encoded by a term h(e(O(α)), Sn (0)). Lemma 5. Let α ∈ CN F , α > 0, n ∈ N \ {0}. Then h(e(O(α)), Sn (0)) →+ D h(e(O(αn )), Sn+1 (0)). Proof. Due to the presence of the rule h(e(x), y) → h(d(x, y), S(y)) in D, it suﬃces to verify that d(O(α), Sn (0)) →+ D e(O(αn )). We proceed by induction on α. 1. Case α = β + 1: By deﬁnition, αn = β and O(α) = g(0, O(β)). Let t = O(α) and s = O(β). To establish d(O(α), Sn (0)) →+ D e(O(αn )), we only need one rewrite step by rule (7): d(g(0, s), Sn (0)) →D e(s) . 2. Case α = β + ω γ+1 : By deﬁnition, αn = β + ω γ · n and t = O(α) = g(g(0, O(γ)), O(β)). Let s = O(β), r = O(γ). Then O(αn ) = g(r, g(r, · · · g(r, s) · · · )) ,

n occurrences of r

and the following rewrite sequence suﬃces: d(g(g(0, r), s), Sn (0)) →+ D g(e(r), g(e(r), · · · d(g(g(0, r), s), 0) · · · )) →D g(e(r), g(e(r), · · · g(e(r), e(s)) · · · )) →+ D e(g(r, g(r, · · · g(r, s) · · · ))) .

n

(10) (9)

n

(11)

3. Case α = β + ω γ , γ ∈ Lim: By deﬁnition, αn = β + ω γn and O(α) = g(O(γ), O(β)). Let t = O(α), s = O(β), r = O(γ), and u = O(γn ). By the induction hypotheses (IH), d(r, Sn (0)) →+ D e(u) holds. Hence, the following rewrite sequence suﬃces: d(g(r, s), Sn (0)) →D g(d(r, Sn (0)), e(s)) →+ D

g(e(u), e(s))

→D e(g(u, s)) .

(8) (IH) (11)

12

6

N. Dershowitz and G. Moser

Termination

We will employ “reduction orders” to prove termination of the Hydra systems. 6.1

Reduction Orders

A rewrite system R and a partial order are compatible if R ⊆ . A rewrite relation that is also a well-founded partial order is called a reduction order. It is easy to see that an interpretation-based term order A is a reduction order if the algebra (A, ) is well-founded and monotone. We say that (A, ) is compatible with a rewrite system R if A is compatible with R. A system R is terminating if no inﬁnite sequence of rewrite steps exists. Thus, R is terminating iﬀ it is compatible with a reduction order . 6.2

Termination Properties

The rules of System D are similar to the original proposed formalization of the Hydra battle. While the rules of System H deﬁning h and g have been kept, the three rules deﬁning d have been replaced by four rules. As given, all but the ﬁrst rule of H and D decrease in a simple recursive path order [5], with precedence d > g > e. The diﬃculty is in arranging for the ﬁrst argument of h to show a decrease, as well. A terminating rewrite system is simply terminating if its termination can be proved by a reduction order, like the recursive path order, that enjoys the subterm property (namely, that subterms are smaller in the order). Theorem 4. System H is terminating, but not simply terminating. Proof. For now, we only prove the easy fact that H is not simply terminating, the termination proof is postponed to Sect. 8. To show that H is not simply terminating, note that the rewrite step h(e(x), e(x)) →H h(d(x, e(x)), S(e(x))) leads to a term that has the initial term embedded (homeomorphically) within it. By the same token, D is not simply terminating. Theorem 5. System D is terminating, but not simply terminating. Again the proof of termination is deferred until Sect. 8. 6.3

Previous Problems

While termination of H, and implicitly of D, has been claimed a number of times in the literature, to our best knowledge no (full, correct) termination proof has been provided.

The Hydra Battle Revisited

13

For example, consider the proof sketch in [7, p. 8]. The idea of the proof is to use a general path order [9] that employs the following interpretations of the function symbols in H into the ordinals: [[g(x, y)]] := ω [[x]] + [[y]] [[d(x, z)]] := pred[[z]]([[x]]) [[S(x)]] := [[x]] + 1

[[h(x, z)]] := [[x]] + [[z]] [[e(x)]] := [[x]] [[0]] := 1 .

The operator predζ is conceived as a suitable extension of the operator αζ for ζ < ω; that is, we can assume predn (α) = αn . One prerequisite to employ a general path order successfully is that, for all ground instances lσ → rσ of rules in H, [[lσ]] [[rσ]] holds. However, by deﬁnition, we have [[d(0, 0)]] = [[d]](1, 1) = 11 = 0 , and therefore [[d(g(d(0, 0), d(0, 0)), 0)]] = [[d]]([[g]]([[d(0, 0)]], [[d(0, 0)]]), 1) = [[d]](1, 1) = 0 < 1 = [[g(e(d(0, 0)), d(d(0, 0), 0))]] . Unfortunately, d(g(d(0, 0), d(0, 0)), 0) → g(e(d(0, 0)), d(d(0, 0), 0)) is an instance of rule (3). Although this problem can be relatively easily rectiﬁed, there is a more serious problem with the proposed interpretation [[·]]. This interpretation is employed as one of the component functions of the general path order; to infer termination, these component functions (and hence the interpretation [[·]]) should be weakly monotone. However, the interpretation function [[d]] is not weakly monotone in its ﬁrst argument: Consider two hydræ a = g(0, d(0, 0)) and b = g(d(0, 0), g(d(0, 0), g(d(0, 0), 0))) with ordinal values [[a]] = ω and [[b]] = 4, respectively. Clearly ω > 4 in the usual comparison of (set-theoretic) ordinals. But, [[d(a, 0)]] = [[d]](ω, 1) = pred1 (ω) = 1 < 3 = pred1 (4) = [[d]](4, 1) = [[d(b, 0)]] . Strictly speaking, one only needs monotonicity for terms that can rewrite to each other, that is, fA (. . . x . . .) > fA (. . . y . . .) when x > y and x →R y; cf. [9, Thm. 2]. (Here A denotes an F -algebra.) But consider rule (4) instantiated as follows: x = d(g(g(0, d(0, 0)), 0), S(b)) → g(d(g(0, d(0, 0)), S(b)), d(g(0, d(0, 0)), b)) = y , where b is deﬁned as above. Then [[g(g(0, d(0, 0)), 0)]] = [[g]](ω, 1) = ω ω + 1 with [[g(0, d(0, 0))]] = ω. Hence [[x]] = [[d]](ω ω + 1, 5) = ω ω > ω 5 + 4 = [[g]](pred5 (ω), pred4 (ω)) = [[y]] and thus both assumptions are fulﬁlled with respect to x and y; unfortunately pred1 (ω ω ) = ω < ω 5 + 3 = pred1 (ω 5 + 4). Proceeding in the same way as above, we again derive a counterexample. To overcome this problem, we introduce (in the next section) a notation system for ordinals and use it, instead, as the domain of our interpretation functions.

14

7

N. Dershowitz and G. Moser

In Preparation

Following an approach taken by Gaisi Takeuti [32], we introduce an alternate notation for ordinals below 0 . This notation will enjoy the desired weak monotonicity property. We deﬁne a subset OT of terms over the signature {ω, +}. (The function symbol ω is unary; the symbol + is varyadic.) We write ω α for ω(α). In the deﬁnition of OT, we make use of an auxiliary subset P ⊂ OT. Deﬁnition 3. The deﬁnition of OT and P proceeds by mutual induction: 1. 0 ∈ OT 2. If α1 , . . . , αm ∈ P, then α1 + · · · + αm ∈ OT. 3. If α ∈ OT, then ω α ∈ P, and ω α ∈ OT. The elements of OT are called ordinal terms and are denoted by lower-case Greek letters. If no confusion can arise, we simply speak of ordinals. To simplify reading, we abbreviate the term ω 0 by 1. For the remainder of this section, the expression “ordinal” will always refer to an element of OT, unless stated otherwise. It follows from the deﬁnition of the set OT that any object in OT diﬀerent from 0 can be written in the following form: ω α1 + ω α2 + · · · + ω αn ,

(12)

where each of the α1 , . . . , αn has the same property.6 However, due to the above deﬁnition, α + 0 is not an ordinal, as 0 ∈ P. To cure this, we introduce a binary operation + on OT: Let α, β ∈ OT be of form ω α1 +· · ·+ω αn , β = ω β1 +· · ·+ω βm . Then α + β is deﬁned as ω α1 + · · · + ω αn + ω β1 + · · · + ω βm . Otherwise, we deﬁne α + 0 = 0 + α = α. We will not distinguish between the binary operation + and its varyadic rendering. Deﬁnition 4 (Takeuti [32]). We inductively deﬁne an equivalence ∼ and a partial order so that they satisfy the following clauses: 1. 0 is the minimal element of . 2. For α ∈ OT of form (12), assume α contains two consecutive terms ω αi and ω αi+1 with αi+1 αi . So, α has the form · · · + ω αi + ω αi+1 + . . . . Let β be obtained by removing the expression “ω αi + ” from α, so that β is of the form · · · + ω αi+1 + . . . . Then α ∼ β. 6

This would not hold had we deﬁned OT to be the set of terms over the signature {ω, +}.

The Hydra Battle Revisited

15

3. Suppose α = ω α1 + · · · + ω αm , β = ω β1 + · · · + ω βn , α1 α2 · · · αm , and β1 β2 · · · βn , hold. (α β means α β or α ∼ β.) Then, α β if either αi βi for some i ∈ [1, m] and αj ∼ βj for all j ∈ [1, i − 1], or m > n and αi ∼ βi holds for all i ∈ [1, n]. Remark 3. Note that ordinal addition + is not commutative, not even up to the equivalence ∼, as we have 1 + ω ∼ ω ∼ ω + 1. We can identify the natural numbers N with the ordinals less than ω, as the usual comparison of natural numbers coincides with the above partial order on ordinal terms less than ω. So, we freely write 1 + 1 as 2, 1 + 1 + 1 as 3, and so on. By deﬁnition, for any α > 0 in OT, there exists a unique β ∈ OT with α ∼ β so that β can be written as ω β1 + ω β2 + · · · + ω βn

with β1 · · · βn ,

(13)

where β1 · · · βn . If β is written in this way, we say that it is in normal-form. The set of all ordinal terms in normal-form together with 0 is denoted NF. The unique normal-form of a given ordinal term α is denoted NF(α). Remark 4. Note that our deﬁnition of the ordinal notation system OT is nonstandard. Usually one identiﬁes α ∈ OT and its normal-form NF(α) and instead of ∼ simply the equality = is written. Any α ∈ NF uniquely represents a set-theoretic ordinals in CNF. The following lemma is immediate: Lemma 6 1. The relation is a linear partial order on NF. 2. The relation is well-founded and otype() = 0 . We extend the well-founded, linear order on NF to a well-founded, partial order on OT. To simplify notation we denote the extended relation with the same symbol, no confusion will arise from this. For α, β ∈ OT deﬁne: α β, if NF(α) NF(β). It follows that is a partial order and that α β γ and α β γ each imply α γ. The next lemma is a direct consequence of the deﬁnitions; we essentially employ the fact that NF(α + β) = NF(NF(α) + NF(β)). Lemma 7. Let α, β, γ ∈ OT. 1. 2. 3. 4. 5.

α + β α, β. ω α α. If α β, then ω α ω β . If α β, then γ + α γ + β and α + γ β + γ. If α ∈ P and α β, γ, then α β + γ.

16

N. Dershowitz and G. Moser

The central idea of the above notation system is the separation of the identity of ordinal terms (denoted by =) and the identity of their set-theoretic counterparts (denoted by ∼). We will see in the next section that this pedantry is essential for a successful deﬁnition of the interpretation functions. Based on and ∼, we deﬁne a partial order and an equivalence relation ≡ on OT. We write N(α) to denote the number of occurrences of ω in α. Note that N(n) = n for any natural number n, since 1 = ω 0 . Deﬁnition 5. Let α, β ∈ OT. We set: 1. α β if α β, N(α) N(β) or α ∼ β, N(α) > N(β) and 2. α ≡ β if α ∼ β, N(α) = N(β). Deﬁne the quasi-order ≡ : α ≡ β, if α ( ∪ ≡) β. Example 3. Consider ω + ω 2 and ω + 3. Then ω + ω 2 ω + 3, as NF(ω + ω 2 ) = ω 2 ω + 3 = NF(ω + 3) and N(ω + ω 2 ) = 5 = N(ω + 3). On the other hand, ω 2 ω + 3 as N(ω + 3) = 5 > 3 = N(ω 2 ). This example shows that the relation ∼ is not compatible with the strict order . Lemma 8. The binary relation is a well-founded order and otype() ≤ 0 . Furthermore, for all n, m ∈ N, n m iﬀ n > m. Proof. That is a partial order is immediate from the deﬁnition. To verify that is well-founded with otype() ≤ 0 , it suﬃces to deﬁne an embedding o : OT → CNF: o(α) := ω NF(α) + N(α). By case analysis on the deﬁnition of , one veriﬁes that for all α, β ∈ OT, α β implies o(α) > o(β). Assume ﬁrst that α β and N(α) N(β). Then, ω NF(α) + N(α) > ω NF(β) + N(β) is immediate from the deﬁnition of the comparison > of set-theoretic ordinals. Now assume α ∼ β and N(α) > N(β). Then, ω NF(α) + N(α) > ω NF(β) + N(β) follows similarly. The second half of the lemma is a direct result of the deﬁnition of and the deﬁnition of N. The following is again a direct consequence of the deﬁnitions: Lemma 9. Let α, β, γ ∈ OT. 1. 2. 3. 4.

If α β, then ω α ω β . If α β, then γ + α γ + β and α + γ ≡ β + γ. α + β ≡ α, γ. ω α α.

Let p : N × N → N denote a ﬁxed polynomial, strictly monotone in each argument.

The Hydra Battle Revisited

17

Deﬁnition 6 (Predecessor). We deﬁne the set of n-predecessors of α induced by p. Let α ∈ OT. Then α[n] := {β | α β and p(N(α), n) N(β)} . The notion of an n-predecessor stems from [12]. However, we follow the idea of norm-based fundamental sequences; cf. [4]. Lemma 10. Let α ∈ OT and let δ denote a -maximal element of α[n]. 1. The set α[n] is ﬁnite. 2. For each β ∈ α[n]: δ ≡ β. Proof. The ﬁrst assertion is trivial. For the second, observe that it follows from the deﬁnition of δ that for all β ∈ α[n], either δ β, β ≡ δ, or β and δ are incomparable with respect to . We prove that the last case can never happen. We assume α > 0, as otherwise the assertion follows trivially. Let β ∈ α[n] be arbitrary but ﬁxed, so that β, δ are incomparable. The ordinals β and δ can only be incomparable if either of the following cases holds: (i) δ ≺ β and N(β) < N(δ), or (ii) δ β and N(β) > N(δ). As the cases are dual, it suﬃces to consider the ﬁrst one. Assume β ∈ N, then δ ∈ N and N(β) = β δ = N(δ), which contradicts the assumption N(δ) > N(β). Hence, we can assume β ω. We deﬁne an ordinal term β ∗ as follows: β ∗ := (N(δ) − N(β)) + β. As β ω, ∗ β ∼ β holds. Furthermore, N(β ∗ ) = N(δ) > N(β), as N(β ∗ ) = (N(δ) − N(β)) + N(β) = N(δ). So, β ∗ β. We show that β ∗ ∈ α[n]: α β ∼ β ∗ implies α β ∗ . And p(N(α), n) N(δ) = N(β ∗ ) implies p(N(α), n) N(β ∗ ). We derive a contradiction to the assumption that δ is -maximal. By the above lemma a -maximal element of α[n] is, up to the equivalence ≡, unique. In the following, for each α ∈ OT and each n ∈ N, we ﬁx an arbitrary -maximal element and denote it with Pn (α). Lemma 11. Let α ∈ OT and suppose α ω. Then N(Pn (α)) = p(N(α), n). Proof. The proof follows the pattern of the proof of the previous lemma.

The following lemma explains why the pedantry in the deﬁnition of the set of ordinal terms OT and the given deﬁnition of the partial order is necessary: Lemma 12. Let α, β ∈ OT, n ∈ N. 1. If α, β > 0 and α β, then Pn (α) Pn (β). 2. If α ≡ β, then Pn (α) ≡ Pn (β). 3. Suppose m > n. Then Pm (α) ≡ Pn (α). We want to emphasize that the ﬁrst property fails for the speciﬁc fundamental sequence (αn )n∈N employed in the deﬁnition of the standard Hydra Battle; cf. Deﬁnition 1: We have ω > m, but ωn = n > m − 1 = (m)n for any m > n.

18

N. Dershowitz and G. Moser

Proof (of the lemma). We only show the ﬁrst point; the arguments for the other points are similar, but simpler. Assume α β. First, we show the lemma for the special-case, where α ∈ N. This assumption implies β ∈ N. Hence, Pn (α) = α − 1 β − 1 = Pn (β). Consider the case α ω. We proceed by cases, according to the deﬁnition of : 1. Subcase α β and N(α) N(β): Then monotonicity of p implies that p(N(α), n) N(β) holds. Thus, β ∈ α[n]. By Lemma 10(2), we conclude Pn (α) β Pn (β), which implies Pn (α) Pn (β). By Lemma 11, we get: N(Pn (α)) = p(N(α), n) p(N(β), n) N(Pn (β)). In summary, we see Pn (α) Pn (β). 2. Subcase α ∼ β and N(α) > N(β): From the assumptions we conclude Pn (β) ∈ α[n], as α ∼ β Pn (β) and p(N(α), n) > p(N(β), n) N(Pn (β)). Hence, Lemma 10 implies Pn (α) Pn (β) or Pn (α) ≡ Pn (β). If the former case holds, the lemma is established. Assume the latter. By deﬁnition of ≡, we see that N(Pn (α)) = N(Pn (β)). On the other hand, we obtain: N(Pn (α)) = p(N(α), n) > p(N(β), n) N(Pn (β)). We have derived a contradiction.

8

Termination

The purpose of this section is to prove Theorem 5. Based on the construction given below, it is easy to see how to also prove Theorem 4; hence, we leave that one to the reader. 8.1

Interpretation

Using the ordinal notation of the previous section, the termination proof is relatively simple. Let F denote the signature of System D. We deﬁne the F -algebra (A, ) · and provide a proof that A is well-founded, which is easy, but – more signiﬁcantly – A is weakly monotone. The domain of A is the set {(α, 1) | α ∈ OT} ∪ {(0, 0)} . · on the pairs as follows: We deﬁne the quasi-order · (β, b) (α, a)

iﬀ (α ≡ β ∧ a = b = 1) or (α ≡ β ∧ a > b) .

The following operations interpret the elements of F : dA :

(α, a), (β, b) → (PN(β) (α), 1) (0, a), (β, b) → (0, 0)

hA :

(α, a), (β, b) → (0, 0)

α = 0

The Hydra Battle Revisited

gA :

19

(α, 1), (β, b) → (β + ω α , 1) (0, 0), (β, b) → (0, 0)

eA :

(α, a) → (α, 1)

SA :

(α, a) → (α + 1, 1)

0A :

(0, 1)

Deﬁne the strict order by replacing ≡ by in the above deﬁnition. The · and naturally extend to terms, denoted · A and A , respectively. orders Fix the parameter in the deﬁnition of n-predecessors: p(m, n) := (m + 1) · (n + 1) . · With the help Let · denote the partial order induced by the quasi-order . of Lemma 12, the following is not diﬃcult to prove. Lemma 13. The F -algebra (A, ) · is weakly monotone and well-founded. · A r, that is, A is a quasiLemma 14. For each rule l → r in D, we have l model of D. Proof. We consider only the rules (8) and (10), as it is easy to check the properties for the other rules. 1. Case d(g(x, y), z) → g(d(x, z), e(y)): We have to show · gA (dA ((α, a), (γ, c)), eA ((β, b))) . dA (gA ((α, a), (β, b)), (γ, c)) One of the following subcases holds (i) α > 0 (ii) α = 0. We may assume subcase (i) holds. Assume otherwise; then it is not hard to see that the right-hand side of the above equation rewrites to (0, 0). From this the claim follows easily. Accordingly, we obtain · dA (gA ((α, 1), (β, b)), (γ, c)) = (Pn (β + ω α ), 1) · (β + ω Pn (α) , 1) = gA (dA ((α, 1), (γ, c)), eA ((β, b))) , for n = N(γ). We have to show that Pn (β +ω α ) ≡ β +ω Pn (α) . By Lemma 7, we obtain β + ω α β + ω Pn (α) . By deﬁnition of the polynomial p and the norm-function N, and Lemma 12 it suﬃces to observe: (N(β + ω α ) + 1)(n + 1) = (N(β) + N(α) + 2)(n + 1) N(β) + 1 + (N(α) + 1)(n + 1) N(β + ω Pn (α) ) .

20

N. Dershowitz and G. Moser

2. Case d(g(g(0, x), y), S(z)) → g(e(x), d(g(g(0, x), y), z)): We show · dA (gA (gA (0A , (α, a)), (β, b)), SA ((γ, c))) · gA (eA ((α, a)), dA (gA (gA (0A , (α, a)), (β, b)), (γ, c))) , for all (α, a), (β, b), (γ, c) ∈ A. By deﬁnition, the left-hand side rewrites to (PN(γ+1) (β + ω α+1 ), 1) , while the right side becomes (PN(γ) (β + ω α+1 ) + ω α , 1) , and we have to show PN(γ)+1 (β + ω α+1 ) ≡ PN(γ) (β + ω α+1 ) + ω α . By Deﬁnition 6 and Lemma 7(5) we obtain: β + ω α+1 PN(γ) (β + ω α+1 ) + ω α . Therefore, it suﬃces to show (N(β + ω α+1 ) + 1)(N(γ) + 2) N(PN(γ) (β + ω α+1 ) + ω α ) , which follows by a simply calculation: (N(β + ω α+1 ) + 1)(n + 2) (N(β + ω α+1 ) + 1)(n + 1) + N(ω α+1 ) N(Pn (β + ω α+1 ) + ω α ) , with n = N(γ). 8.2

Dependencies

Finally, we are in position to prove Theorem 5, and employ a speciﬁc variant of the dependency-pair method of [1]. (This choice of method is not critical; equivalently, a proof by induction upto 0 could be given, or some other method employed.) To keep this paper more-or-less self-contained, we ﬁrst recall some basic deﬁnitions and lemmas. We write to denote the proper subterm relation and for (not necessarily proper) superterm. Let R be some rewrite system and denote the set of all minimal non-terminating terms by T∞ (minimal in the sense of the subterm relation). Lemma 15. For every term t ∈ T∞ there exist a rewrite rule l → r ∈ R, a not top ∗ top −−−− →R lσ −−→R substitution σ, and a non-variable subterm u of r, such that t − rσ uσ and uσ ∈ T∞ . By the lemma, it is not diﬃcult to see that any term in T∞ has a deﬁned root symbol. This, we exploit in the next deﬁnition.

The Hydra Battle Revisited

21

Let R be a rewriting system over a signature F . Let f denote a fresh function symbol with the same arity as f ∈ F and let t denote f(t1 , . . . , tn ), for term t = f (t1 , . . . , tn ). The set DP(R) of dependency pairs is deﬁned as follows: DP(R) := { l→u | l → r ∈ R, r u l, root of u deﬁned} . The nodes of the dependency graph DG(R), for rewrite system R, are the dependency pairs of R and there is an arrow from s → t to u → v if and only if there exist substitutions σ and ρ such that tσ →R uρ . A dp-cycle is a nonempty subset C of dependency pairs of DP(R) if for every two (not necessarily distinct) pairs s → t and u → v in C there exists a nonempty path in C between them. By the above lemma and employing the notion of dependency graph, nontermination of R implies the existence of an inﬁnite sequence of the following form: t1 →∗R t2 →C t3 →∗R t4 →C t5 · · · , where ti ∈ { t | t ∈ T∞ }, C ⊆ DG(R) and the rules in C are applied inﬁnitely often. Such a sequence is called C-minimal. Thus, to prove termination it suﬃces to verify that no such sequences can exist. Theorem 6 (Arts & Giesl [1]). A ﬁnite term-rewriting system R is terminating if no C-minimal sequence exists for any dp-cycle in DG(R). An argument ﬁltering is a mapping ρ that associates with every function symbol either an argument position or a list of argument positions. The signature Fρ contains m-ary function symbols f ρ for any f ∈ F with ρ(f ) = [i1 , . . . , im ]. The mapping ρ naturally gives rise to a function ρ : T (F , V) → T (Fρ , V). Theorem 7 (Arts, Giesl & Ohlebusch [16]). Let R be a term-rewriting system and C be a dp-cycle in DG(R). If there exists an argument ﬁltering and a reduction pair ( , >) such that ρ(R) ⊆ , ρ(C) ⊆ ∪ >, and ρ(C) ∩ > = ∅, then there are no C-minimal rewrite sequences. 8.3

Reduction

The proof depends on the following: · A , A ) forms a reduction pair. Lemma 16. The pair ( · A is a quasi-order that is closed under F -operations Proof. One has to show that and substitutions, that A is well-founded and closed under substitutions, and · A ◦ A ⊆ A . The ﬁrst two items follow directly from the – ﬁnally – that deﬁnitions. Therefore, we only have to verify that, for all (α, a), (β, b), (γ, c) ∈ A, · (β, b) (γ, c), then also (α, a) (γ, c). if (α, a) Without loss of generality, assume a = b = c = 1: Assume otherwise, then a = b = c = 0 is impossible, as (β, 0) (γ, 0) cannot hold. Hence, the only possibility is a = b = 1 and c = 0. But, by deﬁnition of A, this implies γ = 0 and clearly (α, 1) (0, 0).

22

N. Dershowitz and G. Moser

Given that a = b = c = 1 holds, the assumption specializes to α ≡ β γ. We proceed by case analysis on α ≡ β. Either α β and N(α) N(β) or α ∼ β and N(α) N(β). In both cases, α β holds. Hence, by transitivity of , α γ follows. Proof (of Theorem 5). Consider the dependency pairs of D: h(e(x), y) → h(d(x, y), S(y)) h(e(x), y) → d(x, y)

(14) (15)

d(g(g(0, x), y), S(z)) → g(e(x), d(g(g(0, x), y), z)) d(g(g(0, x), y), S(z)) → d(g(g(0, x), y), z)

(16) (17)

d(g(x, y), z) → g(d(x, z), e(y)) d(g(x, y), z) → d(x, z)

(19)

g(e(x), e(y)) → g(x, y)

(20)

(18)

We construct the dependency graph DG(D):

(18) (19) (14)

(15) (17)

(20) (16)

The above interpretation extends to the extra dependency-pair functions f as follows: We set fA equal to fA , with the exception of h, which we deﬁne via hA ((α, a), (β, b)) = (α, a) . Due to Theorems 6 and 7, it suﬃces to deﬁne suitable combinations of argument ﬁlterings and reduction pairs for cycles in DP(D). First, we consider the · A , A ). Due to Lemma 14, it remains to show cycle {14} and reduction pair ( that h(e(x), y) h(d(x, y), S(y)) . (21) Let a : V → A denote an arbitrary assignment with [a]A (x) = (α, a), [a]A (y) = (β, b). If α > 0, then (21) becomes (α, 1) (Pn (α), 1), where n = N(β) and we have to show α Pn (α), which is a consequence of Deﬁnition 6. Assume otherwise α = 0. Then (21) becomes (0, 1) · (0, 0), which follows from the deﬁnition of the relation .

The Hydra Battle Revisited

23

With respect to the remaining dp-cycles, it is easy to see how a suitable combination of argument ﬁlterings and reduction pairs should be deﬁned. In particular, note that these cycles can also be handled by applying the subterm criterion iteratively; cf. [20].

9

While Hydra Do

In this section, we convert the functional Hydra program L into an imperative, while program in stages. First, we replace each function with a similarly named procedure call, and the tail-recursive calls with iteration: procedure H(x): n := 0 while x = nil do n := n + 1 D(n, x) procedure F (n, y, x): for i := 1 to n do x := cons(y, x)

procedure D(n, x): u := car(x) if u = nil then x := cdr(x) else if car(u) = nil then F (n, cdr(u), cdr(x)) else D(n, u) x := cons(u, cdr(x))

Using a stack s, implemented as a list (pushing via cons, popping via car), for the recursive calls to G, and combining all the procedures (x is the input hydra), we get: n := 0 while x = nil do n := n + 1 u := car(x) if u = nil then x := cdr(x) else s := nil while car(u) = nil do s := cons(s, cdr(x)) x := u u := car(x) for i := 1 to n do x := cons(cdr(u), x) while s = nil do x := cons(x, cdr(s)) s := car(s) It is easy to see that the inner loops all terminate. To show that the outer one does, one would need to show that x, qua ordinal, decreases with each outer iteration.

24

N. Dershowitz and G. Moser

The list operations can be arithmetized by using a pairing such as √ function, 2 2 cons(x, y) := (x+y +1) +x. Then nil := 0, car(z) := z − z , and cdr(z) := √ √ z2 + z−z −1. (Any other set of pairing and projection functions would do just as well.) With this in mind, and with a tiny bit of algebraic manipulation, our ﬁnal, wholly arithmetic, hard-to-prove-terminating while program is as follows: n := 0 while x > 0 do n := n + 1√ u := x − x2 if u = 0 √ then x := x − 1 else s := 0 √ while u > u2 √do √ s := s + (s + x2 + x − x)2 x := u √ u := x − x2 for i := 1 √to n do √ x := ( u + x)2 + u − 1 while s > 0 do √ √ 2 2 x := x + (x √ +2 s + s − s) s := s − s √ Finally, the (integer-valued) truncated square-root z can be computed each time by a simple loop, searching for the largest integer whose square is no more than z: n := 0 while x > 0 do n := n + 1 y := 0; while y 2 + 2y ≤ x do y := y + 1 if x = y 2 then x := y − 1 else s := 0 r := 0; while r2 + 2r ≤ x − y 2 do r := r + 1 while x > y 2 + r2 do y := 0; while y 2 + 2y ≤ x do y := y + 1 s := s + (s + y 2 + y − x)2 x := x − y 2 r := 0; while r2 + 2r ≤ x − y 2 do r := r + 1 for i := 1 to n do x := r2 + r − 1 while s > 0 do r := 0; while r2 + 2r ≤ s do r := r + 1 x := x + (x + r2 + r − s)2 s := s − r2 Further simpliﬁcations are possible.

The Hydra Battle Revisited

10

25

The Sky’s the Limit

David Gries [18] has averred that for deterministic (or bounded nondeterministic) programs, since the number of steps of any terminating program is just some integer-valued function t(¯ x) that depends only on the program inputs x¯, it is preferable to prove termination by showing “that each execution of the loop body decreases t by at least 1”, than to use complicated well-founded orderings. This begs the issue, however, since the proof such a t exists for a program like Hydra requires transﬁnite induction up to 0 , as we have seen above. It is not hard to conjure up bigger battles, for example ones in which trees also grow in height. The following one – meant to require Γ0 – is from [6]: Gn (x) → Gn+1 (pn x) pn x, y, z → x, y, pn z pn+1 A, y, z → A, pn+1 y, rn B, A, y, z, z pn x, y, z → y pn B, y, z → rn B, y, z rn+1 B, y, z → B, pn+1 y, rn B, y, z rn x, y, z → z x, y, z → x, y, z The A nodes are meant to act lexicographically; the B nodes, more like multisets. The bar acts like e of the Hydra system. Regarding the relevance to computer science of the (least) impredicative ordinal Γ0 , see [14]. Moreover, Γ0 is by no means the end of the games. See [25] for rewrite systems that formalize the Hydra Battle up to the small Veblen ordinal, the maximal order type of the lexicographic path order [8]. Even larger hydras (so called Buchholz Hydræ) have been considered by Wilfried Buchholz [3].

References 1. Arts, T., Giesl, J.: Termination of term rewriting using dependency pairs. Theor. Comput. Sci. 236, 133–178 (2000) 2. Baader, F., Nipkow, T.: Term Rewriting and All That. Cambridge University Press, Cambridge (1998) 3. Buchholz, W.: An independence result for (Π11 − CA) + BI. Ann. Pure Appl. Logic 33, 131–155 (1987) 4. Buchholz, W., Cichon, E.A., Weiermann, A.: A uniform approach to fundamental sequences and hierarchies. MLQ Math. Log. Q. 40, 273–286 (1994) 5. Dershowitz, N.: Orderings for term-rewriting systems. Theor. Comput. Sci. 17(3), 279–301 (1982) 6. Dershowitz, N.: Trees, ordinals, and termination. In: Gaudel, M.-C., Jouannaud, J.-P. (eds.) CAAP 1993, FASE 1993, and TAPSOFT 1993. LNCS, vol. 668, pp. 243–250. Springer, Heidelberg (1993)

26

N. Dershowitz and G. Moser

7. Dershowitz, N.: 33 examples of termination. French Spring School of Theoretical Computer Science. In: Comon, H., Jouannaud, J.-P. (eds.) Advanced Course on Term Rewriting. LNCS, vol. 909, pp. 16–26. Springer, Heidelberg (1995) 8. Dershowitz, N., Okada, M.: Proof-theoretic techniques for term rewriting theory. Proceedings of the 3rd Annual Symposium on Logic in Computer Science, pp. 104–111. IEEE (1988) 9. Dershowitz, N., Hoot, C.: Natural termination. Theor. Comput. Sci. 142(2), 179– 207 (1995) 10. Dershowitz, N., Jouannaud, J.P.: Rewrite systems. In: van Leeuwen, J. (ed.) Formal Methods and Semantics. Handbook of Theoretical Computer Science, Chap. 6, vol. B, pp. 245–319. Elsevier Science, North-Holland, Amsterdam (1990) 11. Dershowitz, N., Jouannaud, J.-P., Klop, J.W.: Open problems in rewriting. In: Book, R.V. (ed.) Rewriting Techniques and Applications. LNCS, vol. 488, pp. 445–456. Springer, Heidelberg (1991) 12. Fairtlough, M.V.H., Wainer, S.S.: Hierarchies of provably recursive functions. In: Buss, S.R. (ed.) Handbook of Proof Theory, pp. 149–207. Elsevier Science, NorthHolland, Amsterdam (1998) 13. Fleischer, R.: Die another day. Proceedings of the 4th International Conference FUN with Algorithms. LNCS, vol. 4475, pp. 146–155. Springer Verlag, Heidelberg (2007), http://www.cs.ust.hk/∼ rudolf/Paper/hydra fun07.pdf 14. Gallier, J. H.: What’s so special about Kruskal’s Theorem and the ordinal Γ0 ? A survey of some results in proof theory. Ann. Pure Appl. Logic, 53(3), 199–260 (1991); Erratum, Ann. Pure Appl. Logic 89(2–3), 275 (1997). http://handle.dtic.mil/100.2/ADA290387. 15. Gardner, M.: Mathematical games: Tasks you cannot help ﬁnishing no matter how hard you try to block ﬁnishing them, Scientiﬁc American 24(2),12–21 (Reprinted in Martin Gardner, The Last Recreations) pp. 27–43, Springer Verlag, Heidelberg (1998) 16. Giesl, J., Arts, T., Ohlebusch, E.: Modular termination proofs for rewriting using dependency pairs. J. of Symbolic Computation 34, 21–58 (2002) 17. Goodstein, R.L.: On the restricted ordinal theorem. J. Symbolic Logic 9, 33–41 (1944) 18. Gries, D.: Is sometimes ever better than alway? ACM Transactions on Programming Languages and Systems 0, 258–265 (1979), http://doi.acm.org/10.1145/357073.357080 19. Hemelrijk, J.M., Hydriae, C.: American Journal of Archaeology 89(4), 701–703 (1985) 20. Hirokawa, N., Middeldorp, A.: Dependency pair revisted. In: van Oostrom, V. (ed.) RTA 2004. LNCS, vol. 3091, pp. 249–268. Springer, Heidelberg (2004) 21. Hodgson, B. R.: Herculean or Sisyphean tasks. Newsletter of the European Mathematical Society, vol. 51 (2004) 22. Jech, T.J.: Set Theory. Springer Verlag, Heidelberg (2002) 23. Jouannaud, J.-P.: Proof and computation. In: Schwichtenberg, H. (ed.) NATO series F: Computer and Systems Sciences, vol. 139, pp. 173–218. Springer Verlag, Heidelberg (1995), http://rewriting.loria.fr/documents/rpac.ps.gz 24. Kirby, L., Paris, J.: Accessible independence results for Peano arithmetic. Bull. London Mathematical Society 4, 285–293 (1982) 25. Lepper, I.: Simply terminating rewrite systems with long derivations. Arch. Math. Logic 43, 1–18 (2004) 26. Lescanne, P.(ed.) Rewriting mailing list. (February 19 2004) https://listes.ens-lyon.fr/wws/arc/rewriting,

The Hydra Battle Revisited

27

27. Luccio, F., Pagli, L.: Death of a monster. SIGACT News. 31(4), 130–133 (2000), http://doi.acm.org/10.1145/369836.369904 28. March´e, C., Zantema, H.: The termination competition. In: Baader, F. (ed.) RTA 2007. LNCS, vol. 4553, Springer, Heidelberg (to appear 2007) 29. Moser, G., Weiermann, A.: Relating derivation lengths with the slow-growing hierarchy directly. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706, pp. 296–310. Springer, Heidelberg (2003) 30. Paris, J., Harrington, L.: A mathematical incompleteness in Peano arithmetic. In: Barwise, J. (ed.) Handbook for Mathematical Logic, North-Holland, Amsterdam (1977) 31. Penn State College of Information Sciences and Technology. CiteSeer Scientiﬁc Literature Digital Library. http://citeseer.ist.psu.edu. 32. Takeuti, G.: Proof Theory. 2nd edition. North-Holland, Amsterdam (1987) 33. Terese, Bezem, M., Klop, J.W., de Vrijer, R.: Term Rewriting Systems. In: Cambridge Tracks in Theoretical Computer Science, vol. 55, Cambridge University Press, Cambridge (2003) 34. Touzet, H.: Encoding the Hydra battle as a rewrite system. In: Brim, L., Gruska, J., Zlatuˇska, J. (eds.) MFCS 1998. LNCS, vol. 1450, pp. 267–276. Springer, Heidelberg (1998) 35. A. M. Turing.: Checking a large routine. In: Report of a Conference on High Speed Automatic Calculating Machines, Univ. Math. Lab. Cambridge, pp. 67-69 (1949). Reprinted in Morris, F. L., Jones, C. B.: An early program proof by Alan Turing. Annals of the History of Computing, vol. 6, pp. 139–143, (1984) http://www.turingarchive.org/browse.php/B/8. 36. Wainer, S.S.: Ordinal recursion, and a reﬁnement of the extended Grzegorezyk hierarchy. J. Symbolic Logic 37, 281–292 (1972)

Orderings and Constraints: Theory and Practice of Proving Termination Cristina Borralleras1 and Albert Rubio2, 1

2

Universitat de Vic, Spain [email protected] Universitat Polit`ecnica de Catalunya, Barcelona, Spain [email protected]

Abstract. In contrast to the current general way of developing tools for proving termination automatically, this paper intends to show an alternative program based on using on the one hand the theory of term orderings to develop powerful and widely applicable methods and on the other hand constraint based techniques to put them in practice. In order to show that this program is realizable a constraint-based framework is presented where ordering based methods for term rewriting, including extensions like Associative-Commutative rewriting, ContextSensitive rewriting or Higher-Order rewriting, as well as the use of rewriting strategies, can be put in practice in a natural way.

1

Introduction

In this paper we show how to translate into a constraint solving problem any termination proof using the Monotonic Semantic Path Ordering (MSPO) [BFR00] and its variants for Associative-Commutative (AC) rewriting [BR03], HigherOrder (HO) rewriting [BR01] and Context-Sensitive (CS) rewriting [Bor03]. By using the deﬁnition of MSPO a disjunction of constraints is obtained, such that, if any of these constraints can be solved, then the TRS is proved to be terminating. Our constraints have the same semantics as the ones obtained in the dependency pair method (DP) [AG00], and, in particular, one of the constraints obtained from the deﬁnition of the MSPO coincides with the one given by DP method (and it is unclear whether this one is always the best to be solved). Moreover, since both kind of constraints share the same semantics, we can reuse all techniques developed to solve DP constraints like the DP graph or many other further developments [AG00, GTSK04, HM05, GTSKF06]. The framework we propose was ﬁrst described in [Bor03]. A similar framework for the DP-method was independently proposed in [GTSK04]. These results show that MSPO can be seen as an ordering-based way to understand the DPmethod, and that the key point for the success of this method is the use, in

Supported by spanish project LOGICTOOLS, ref. TIN2004-07925.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 28–43, 2007. c Springer-Verlag Berlin Heidelberg 2007

Orderings and Constraints: Theory and Practice of Proving Termination

29

practice, of ordering constraints, for which a wide variety of sound solvers have been developed. Additionally, we study the application of our techniques to prove termination of innermost rewriting. In order to reuse our framework, the TRS is modiﬁed by adding constraints to the rules, which approximate the restrictions imposed by the strategy. A constrained rule can be applied if the substitution satisﬁes the constraint. Hence, a TRS is innermost terminating if its constrained version is terminating. A constrained TRS is terminating if all instances of each constrained rule (i.e. the instances satisfying the constraint) are included in a reduction ordering. Therefore, we can apply MSPO but taking the constraints of the rules into account. This is done by inheriting the constraints when applying MSPO. As a result, we obtain a disjunction of constrained constraints, which, to avoid confusion, will be called decorated constraints (note that the constraints coming from the rules are applied to the ordering constraints coming from MSPO). Using these decorated constraints we can cover all techniques applied in the DP method for innermost rewriting. Furthermore, these decorated constraints can be used to store other information which can be relevant for the termination proof. The same ideas applied to the innermost strategy can be applied, as well, to other strategies that can be approximated by means of constrained rules, like, for instance, rewriting with priorities [vdP98]. Finally, we show, as an example, how our framework also extends to the higher-order version of the MSPO, which can also be done for the AC-version and the CS-version. These results should be seen as a proof of the thesis that developing results at the ordering level and implementing and applying them at the constraint level is an appropriate program to obtain a general purpose tool for proving termination. Our method has been implemented in a system called Termptation which automatically proves termination of rewriting and innermost rewriting. The implementation does not cover any of the extensions of MSPO to associativitycommutativity, higher-order or context-sensitive rewriting, which is planed for future development. Basic notions and deﬁnitions are given in section 2. In sections 3 and 4 we revise the dependency pair method and the monotonic semantic path ordering respectively. Section 5 is devoted to present and apply our constraint framework. In section 6 we adapt our framework to deal with innermost rewriting and in section 7 we consider higher-order rewriting. Some conclusions are given in section 8. An extended version of these results and all proofs can be found in [Bor03].

2

Preliminaries

In the following we consider that F is a set of function symbols, X a set of variables and T (F , X ) is the set of terms built from F and X . Let s and t be arbitrary terms in T (F , X ), let f be a function symbol in F and let σ be a

30

C. Borralleras and A. Rubio

substitution. A (strict partial) ordering is a transitive irreﬂexive relation. It is monotonic if s t implies f (. . . s . . .) f (. . . t . . .), and stable under substitution if s t implies sσ tσ. Monotonic orderings that are stable under substitutions are called rewrite orderings. A reduction ordering is a rewrite ordering that is well-founded : there are no inﬁnite sequences t1 t2 . . . A term rewrite system (TRS) is a (possibly inﬁnite) set of rules l → r where l and r are terms. Given a TRS R, s rewrites to t with R, denoted by s →R t, if there is some rule l → r in R, s|p = lσ for some position p and substitution σ and t = s[rσ]p . The deﬁned symbols D are the root symbols of left-hand sides of rules. All other function symbols are called constructors. A TRS R is terminating if there exists no inﬁnite sequence t1 →R t2 →R . . . + Thus, the transitive closure →R of any terminating TRS is a reduction ordering. Furthermore, reduction orderings characterize termination of TRSs, i.e. a rewrite system R is terminating if and only if all rules are contained in a reduction ordering , i.e., l r for every l → r ∈ R. Given a relation , the multiset extension of on ﬁnite multisets, denoted by , is deﬁned as the smallest transitive relation containing X ∪ {s} X ∪ if s ti for all i ∈ {1 . . . n}. If is a well-founded ordering on {t1 , . . . , tn } terms then is a well-founded ordering on ﬁnite multisets of terms. A quasi-ordering is a transitive and reﬂexive binary relation. Its inverse is denoted by . Its strict part is the strict ordering \ (i.e, s t iﬀ s t and s t). Its equivalence ∼ is ∩ . Note that is the disjoint union of and ∼, and that if = denotes syntactic equality then ∪ = is a quasi-ordering whose strict part is . is monotonic if f (. . . , s, . . .) f (. . . , t, . . .) whenever s t. An ordering 2 is compatible with a quasi-ordering 1 if 1 · 2 ⊆2 . Let 1 be a quasi-ordering and let 2 be an ordering. Then 1 , 2 is a compatible ordering pair if 2 and 1 are stable under substitutions, 2 is compatible with 1 and 2 is well-founded. A precedence F is a well-founded quasi-ordering on F . It is extended to a quasi-ordering on terms as s F t iﬀ top(s) F top(t).

3

The Dependency Pair Method

For every deﬁned symbol f ∈ D, we introduce a fresh tuple symbol f # (sometimes written as F for simplicity) with the same arity. If t = f ( t ) then t# denotes the term f # ( t ). If l → r ∈ R and t is a subterm of r with a deﬁned root symbol, then l# , t# is a dependency pair of R. The set of all dependency pairs of R is denoted DP (R). An R-chain is a sequence s1 , t1 , s2 , t2 , . . . of pairs in DP (R) such that there is a substitution σ where ti σ →∗R si+1 σ. Theorem 1 (Termination Criterion [AG00]). A TRS R is terminating if and only if no inﬁnite R-chain exists. Deﬁnition 1. A pair I , q is called a DP-reduction pair if I is monotonic, and I , q is a compatible ordering pair.

Orderings and Constraints: Theory and Practice of Proving Termination

31

Then a TRS R is terminating if there is a DP-reduction pair I , q such that l I r for every rule in R and s q t for every dependency pair s, t in DP (R). Many reﬁnements and improvements for solving the obtained constraints have been described. See [GTSK04] for a general framework for solving DPconstraints.

4

The Monotonic Semantic Path Order

Let us now recall the deﬁnition of the semantic path ordering (SPO) [KL80], with a slight modiﬁcation, since we use a compatible ordering pair instead of a quasi-ordering as underlying (or base) ordering: Deﬁnition 2. Given a compatible ordering pair Q , q , the SPO, denoted as spo , is deﬁned as s = f (s1 , . . . , sm ) spo t iﬀ 1. si spo t, for some i = 1, . . . , m, or 2. s q t = g(t1 , . . . , tn ) and s spo ti for all i = 1, . . . , n, or 3. s Q t = g(t1 , . . . , tn ) and {s1 , . . . , sm } spo {t1 , . . . , tn }, where spo is deﬁned as spo ∪ =. The semantic path ordering is well-deﬁned, but, in general, it is not monotonic, even when Q is monotonic (in fact, the same problem appears if Q is monotonic). Deﬁnition 3. We say that I is monotonic on Q (or Q is monotonic wrt. I ) if s I t implies f (. . . s . . .) Q f (. . . t . . .) for all terms s and t and function symbols f . A pair I , Q is called a reduction pair if I is monotonic, Q is wellfounded, I , Q and Q are stable under substitutions and I is monotonic on Q . A triplet I , Q , q is called a reduction triplet if I is monotonic, I is stable under substitutions, Q , q is a compatible ordering pair and I is monotonic on Q . Note that in particular, if I , Q is a reduction pair then I , Q , Q is a reduction triplet. Now we deﬁne the monotonic semantic path ordering (MSPO) [BFR00]: Deﬁnition 4. Let I , Q , q be a reduction triplet. The corresponding monotonic semantic path ordering, denoted by mspo , is deﬁned as: s mspo t if and only if s I t and s spo t Theorem 2. mspo is a reduction ordering. Furthermore, MSPO characterizes termination.

32

5

C. Borralleras and A. Rubio

Reduction Constraints

In this section we present the constraint framework where our termination problems are translated to. We will ﬁrst present the syntax and semantics of our constraints. Then, we show how the termination problems are translated into constraint problem through the deﬁnition of the MSPO. Then, we present some transformation techniques in order to solve the obtained constraints and show how the DP method is included in ours. Finally, we show how all other transformation techniques applied in the DP framework apply to ours. 5.1

Syntax and Semantics

Deﬁnition 5. A reduction constraint is a pair C1 , C2 , where C1 is a conjunction of positive literals over the relation 1 and C2 is conjunction of positive literals over 2 and 2 . Now we provide the notion of satisﬁability for reduction constraints, which is based on reduction triplets. Hence, it is easy to show that these kind of constraints are the ones obtained by applying MSPO. Deﬁnition 6. A reduction constraint C1 , C2 is satisﬁable iﬀ there exists a reduction triplet ≥1 , ≥2 , >2 such that ≥1 satisﬁes C1 and ≥2 , >2 satisﬁes C2 , i.e. ≥2 satisﬁes all literals s 2 t in C2 and >2 satisﬁes all literals s 2 t in C2 . The following deﬁnition and theorem allow us to connect the reduction triplet semantics given above for reduction constraints with the R-chain semantics given for the constraints obtained by the dependency pair method. In what follows, we will speak about the relation 1 in C1 , or simply 1 , as the relation deﬁned by all instances of all s 1 t in C1 . We have not used a new relation symbol to ease the reading. The same will be done for the relation 2 in C2 (or simply 2 ) and the relation 2 in C2 (or simply 2 ). λ ∗

Then, we use −→1 for the reﬂexive and transitive closure of the monotonic with non-empty contexts (and stable under substitution) closure of 1 in C1 . Deﬁnition 7. Let C1 , C2 be a reduction constraint. A pair s, t O , with O being either 2 or 2 , is said to be in C2 iﬀ s O t occur in C2 (up to renaming of variables). It is said to be strict if O is 2 . A sequence of pairs of terms s1 , t1 O1 , s2 , t2 O2 , . . . is a chain in C1 , C2 if λ ∗

every si , ti Oi is in C2 and there exists a substitution σ such that ti σ −→1 si+1 σ holds for all consecutive pairs si , ti Oi and si+1 , ti+1 Oi+1 in the sequence. Lemma 1. If C1 = {l 1 r | ∀l → r ∈ R} the notion of R-chain using dependency pairs coincides with the notion of chain using our pairs s, t O . Theorem 3. A reduction constraint C1 , C2 is satisﬁable iﬀ there is no chain in C1 , C2 with inﬁnitely many strict pairs.

Orderings and Constraints: Theory and Practice of Proving Termination

33

From this theorem it follows that the constraints obtained by the dependency pair method are reduction constraints, as we will show in detail in section 5.4. 5.2

Translating MSPO-Termination of Rewriting into Reduction Constraint Solving

Using MSPO, we can translate our termination problem into a reduction constraint solving problem. This translation is simply based on applying the deﬁnition of MSPO, and SPO, to the rules of the TRS. Let R be a set of rules {li → ri | 1 ≤ i ≤ n}. We consider the following initial MSPO-constraint: l1 mspo r1 ∧ . . . ∧ ln mspo rn Which is transformed by applying the deﬁnition of MSPO into a conjunction of two constraints, CI and CSP O CI : l1 I r1 ∧ . . . ∧ ln I rn CSP O : l1 spo r1 ∧ . . . ∧ ln spo rn Now the deﬁnition of SPO given in Section 4 is applied to the second part of the constraint. This is formalized by means of correct constraint transformation rules: if s ≡ t s spo t =⇒ s spo t =⇒ s spo t if s ≡ t x spo t =⇒ ⊥ s spo x =⇒ if s ≡ x ∈ V ars(s) s = f (s1 , . . . , sm ) spo g(t1 , . . . , tn ) = t =⇒ s1 spo t ∨ . . . ∨ sm spo t ∨ (s q t ∧ s spo t1 ∧ . . . ∧ s spo tn )∨ (s Q t ∧ {s1 , . . . , sm } spo {t1 , . . . , tn }) where {s1 , . . . , sm } spo {t1 , . . . , tn } is translated into a constraint over spo and spo . It is easy to see that these transformation rules are correct, terminating and conﬂuent. Moreover, the resulting normal form is an ordering constraint over q and Q which represents the conditions on q and Q that are necessary to show that CSP O is true. Then after computing the disjunctive normal form, the initial constraint CSP O has been translated into a disjunction of constraints over q and Q each one of the form CQ :

s1 q t1 ∧ . . . ∧ sp q tp ∧ s1 Q t1 ∧ . . . ∧ sq Q tq

where none of the terms are variables. Now we have to ﬁnd a reduction triplet I , Q , q satisfying CI and one of these constraints CQ , which means that this is a reduction constraint satisfaction problem as the following theorem states.

34

C. Borralleras and A. Rubio

Theorem 4. Let R be a TRS and let CI be the constraint over I and let 1 k CQ ∨ ... ∨ CQ be the disjunction of constraints over q and Q obtained by applying the MSPO method. Then R is terminating iﬀ some reduction constraint i

is satisﬁable. CI , CQ From the previous theorem, in order to prove termination, we have to show i

is satisﬁable. To this end, we have to that some reduction constraint CI , CQ provide some correct (wrt. satisﬁability) constraint transformation techniques which allow us to simplify the constraints until they can directly be shown to be satisﬁable by building an actual reduction triplet (or pair). From now on, we will assume that we have a reduction constraint C1 , C2 , which is transformed step by step, preserving satisﬁability, into one or several simpler reduction constraints of the form S1 , S2 . After this simpliﬁcation process, each resulting reduction constraint S1 , S2 is proved satisﬁable separately by building an appropriate reduction quasi-ordering (or a compatible ordering pair , where is monotonic), which includes all literals in S1 and S2 . Note that, if is a reduction quasi-ordering and is the strict part of it, then , , is a reduction triplet. 5.3

Constraint Transformations

In this section we propose some basic techniques for simplifying the reduction constraint C1 , C2 . A ﬁrst simple example of such a simpliﬁcation, is obtained by using a wellfounded precedence on the set of symbols. Thus every literal s 2 t or s 2 t can be removed if the top symbol of s is strictly greater than the top symbol of t in the precedence. Moreover, the remaining literals s 2 t or s 2 t in C2 have to fulﬁl that the top symbol of s is greater than or equal to the top symbol of t in the precedence. Being precise, if F is a precedence, such that top(s) F top(t) for every s 2 t or s 2 t in C2 , then we can simplify the constraint C2 by using the following rules: Precedence simpliﬁcation rules s 2 t =⇒ if top(s) F top(t) s 2 t =⇒ if top(s) F top(t) By building appropriate reduction triplets, we can easily show the correctness of this transformation. Transformation 1. Let C1 , C2 be a reduction constraint and let C1 , C2 be a reduction constraint obtained by applying the precedence simpliﬁcation rules wrt. some precedence F such that top(s) F top(t) for every s 2 t or s 2 t in C2 . Then C1 , C2 is satisﬁable if and only if C1 , C2 is satisﬁable. Moreover, if we choose adequately the precedence we can apply an optimal simpliﬁcation with respect to this precedence-based transformation.

Orderings and Constraints: Theory and Practice of Proving Termination

35

Now we present a transformation technique, based on renamings of top function symbols (as already done in the dependency pair method). This transformation is not a simpliﬁcation in the sense that no literal is removed, but it allows us to apply, in the future, a diﬀerent treatment to the symbols when they occur on top of a term in C2 (which will ease the proof of satisﬁability of the ﬁnal reduction constraint obtained after all the simpliﬁcation process). Transformation 2. (Renaming) Let C1 , C2 be a reduction constraint and let C2 the result of renaming all function symbols f heading a term in C2 by a new symbol f # . Then C1 , C2 is satisﬁable iﬀ C1 , C2 is satisﬁable. 5.4

Reduction Constraints and the DP Method

In this section we show that the constraints obtained in our method have the same semantics as the ones produced by the dependency pair method. In particular, we show that one of the constraints obtained in the disjunction when using the MSPO constraint method coincides, after applying the precedence and the renaming transformations, with the one given by the DP method. The following results states that the constraint obtained by the dependency pair method is a reduction constraint. Theorem 5. Let R be a TRS and let C1 be the constraint containing li 1 ri for every rule li → ri in R and let C2 be the constraint containing s 2 t for every dependency pair s, t in DP (R). Then R is terminating iﬀ the reduction constraint C1 , C2 is satisﬁable. Now, using always case 2 of the deﬁnition of SPO, except when the term on the right is a variable (where we apply case 1), and applying precedence transformation (with deﬁned symbols greater than constructors) and ﬁnally the renaming transformation we get the constraint given by the DP method. Moreover, it is not diﬃcult to prove that there is a reduction triplet I , Q , q if and only if there is a DP-reduction pair I , q solving the resulting reduction constraint. Theorem 6. The dependency pair method is included in the MSPO constraint method. The following example shows a case in which the constraint obtained by DPmethod is, in principle, not the easiest one to be solved among all constraints generated by MSPO. Example 1. The following system is an automatic translation of a prolog program that computes the Ackermann function. ack in(0, x) → ack out(s(x)) ack in(s(y), 0) → u11(ack in(y, s(0))) u11(ack out(x)) → ack out(x) ack in(s(y), s(x)) → u21(ack in(s(y), x), y) u21(ack out(x), y) → u22(ack in(y, x)) u22(ack out(x)) → ack out(x)

36

C. Borralleras and A. Rubio

This system has been proved included in the MSPO with a constraint which for the rule u21(ack out(x), y) → u22(ack in(y, x)) contains the following literals which correspond to the application of case 2 ﬁrst and then case 3 of the SPO: u21(ack out(x), y) q u22(ack in(y, x)) u21(ack out(x), y) Q ack in(y, x) Note that with the DP-method both, at least initially, would be strict. Similarly, the constraint framework deﬁned in [GTSK04] is basically the same as the one described in this paper, except on the fact that, since we extract our constraints from the deﬁnition of MSPO, our constraint C2 may include non-strict inequalities from the beginning. Due to this equivalence between both frameworks all sound transformation techniques described in [GTSK04] (called there processors), including , for instance, the DP graph or many other ideas developed in [AG00, HM05, GTSKF06] can be used in our framework and vice versa.

6

Innermost Rewriting: Constrained Rules

In innermost rewriting, a subterm is a redex only if all arguments are in normal form. Therefore, we can impose this condition on the left-hand sides of the rules. In this section we show a way to keep this condition aside of the rules and then use this information to prove innermost termination with the reduction constraint framework. i

Deﬁnition 8. Let R be a TRS. Then s −→R t is an innermost rewriting step if s = u[lσ], t = u[rσ], l → r ∈ R, and all the proper subterms of lσ are in normal form, that is, lσ is irreducible in non-top positions. As a ﬁrst consequence of the above deﬁnition, when using innermost rewriting, all the rules in a TRS which has a proper subterm l|p such that for any normal substitution σ, l|p σ is a redex, can be eliminated. Note that we can still have rules which have a proper subterm l|p such that l|p σ is a redex for some normal substitution σ, but not in general. To prove innermost termination of a TRS, we have to show that any innermost reduction is ﬁnite, which can be proved by showing that any innermost reduction is included in a well-founded ordering. Theorem 7. A rewrite system R over a set of terms T (F , X ) is innermost terminating if and only if there is a well-founded, monotonic ordering over T (F , X ) such that for every l → r ∈ R and for all substitutions σ such that lσ is irreducible in non-top positions, lσ rσ.

Orderings and Constraints: Theory and Practice of Proving Termination

37

Note that if a term t is irreducible then any subterm of t is also irreducible. Thus, the condition ”lσ is irreducible in non-top positions” in the above theorem can also be written as ”li σ is irreducible for all li argument of l”. This condition of irreducibility can be expressed by adding a constraint to the rules. For instance, given the rules f (x, g(x)) → f (1, g(x)) g(1) → g(0) the innermost condition can be expressed by the constrained rules f (x, g(x)) → f (1, g(x)) | {irred(x), irred(g(x))} g(1) → g(0) | {irred(1)} Let us formalize the notion of constrained rule and its use in innermost rewriting. Deﬁnition 9. Given a rule l → r and a conjunction K of literals build on a given set of predicates, we say that l → r | K is a constrained rule. A rewrite step using a constrained rule l → r | K is a rewrite step using l → r which is only applicable for those substitutions σ satisfying K, i.e., s → t using the constrained rule l → r | K iﬀ s = u[lσ] → u[rσ] = t for some context u and substitution σ solution of K. Now we show that by using constrained rewriting with irreducibility constraints we can characterize the innermost rewriting strategy. Deﬁnition 10. Let R be a set of rules. The set Ri of constrained rules for innermost rewriting contains for each rule l → r ∈ R a constrained rule l → r | K i (l) where K i (f (t1 , . . . , tn )) = {irredR (ti ) | ∀i ∈ {1, . . . , n}} and irredR (t) means that t is irreducible with respect to R. Irreducibility constraints are used in the CARIBOO system [FGK02], by means of abstraction constraints. However, our aim when using these constraints is to be able to apply the same constraint solving techniques as in the innermost version of the DP method, like, for instance, when building the approximated innermost DP graph. i

Lemma 2. Let R be a set of rules. Then, s −→ t using l → r ∈ R if and only if s → t using the constrained rewrite rule l → r | K i (l) ∈ Ri This notion of constrained rewriting can be generalized other relations like orderings. Deﬁnition 11. Given two terms s and t and a set of literals K, s t | K denotes that sσ tσ for all solutions σ of K; and s t | K denotes that sσ tσ for all solutions σ of K. The following theorem for innermost termination follows from Theorem 7 using Lemma 2 and Deﬁnition 11.

38

C. Borralleras and A. Rubio

Theorem 8. Let be a reduction ordering. A TRS R is innermost terminating iﬀ l r | K i (l) holds for every rule l → r ∈ R. Corollary 1. A TRS R is innermost terminating iﬀ there exists a reduction triplet I , Q , q s.t. l mspo r | K i (l), for every l → r ∈ R. In order to be able to use constrained rules in our method, ﬁrst we have to adapt the notion of reduction constraints. 6.1

Decorated Reduction Constraints

We will now increase the expressive power of our reduction constraints C1 , C2 by attaching conditions to the pairs in C1 and C2 . These conditions will contain all or part of the information coming from the constraints of the rules. Deﬁnition 12. A decorated literal (or pair) l | D is a literal (pair) l with an attached condition D. A decorated reduction constraint is a tuple C1 , C2 , where C1 is a conjunction of decorated positive literals over the relation 1 and C2 is a conjunction of decorated positive literals over 2 and 2 . Deﬁnition 13. A decorated reduction constraint C1 , C2 is satisﬁable iﬀ there exists a reduction triplet ≥1 , ≥2 , >2 such that ≥1 satisﬁes C1 and ≥2 , >2 satisﬁes C2 , i.e., ≥2 satisﬁes all decorated literals s 2 t | D in C2 and >2 satisﬁes all decorated literals s 2 t | D in C2 . From this, all deﬁnitions and results given for reduction constraints can be extended in a natural way to decorated reduction constraint (see [Bor03] for details). 6.2

Proving Termination of Constrained Rules by MSPO Using Decorated Reduction Constraints

We can translate the termination problem of a set of constrained rules into an ordering constraint solving problem using decorated reduction constraints. This translation is simply based on applying the deﬁnition of MSPO, and SPO, to a set of constrained rules. Let R be a set of constrained rules {(li → ri | Ki ) | 1 ≤ i ≤ n}. We consider the following initial MSPO-constraint: l1 mspo r1 | K1 ∧ . . . ∧ ln mspo rn | Kn This decorated ordering constraint is transformed by applying the deﬁnition of MSPO into the conjunction of two decorated ordering constraints, CI and CSP O CI : l1 I r1 | K1 ∧ . . . ∧ ln I rn | Kn CSP O : l1 spo r1 | K1 ∧ . . . ∧ ln spo rn | Kn

Orderings and Constraints: Theory and Practice of Proving Termination

39

Now the deﬁnition of SPO given in Section 4 is applied to the second part of the constraint. This is formalized by means of correct constraint transformation rules: s spo t | K =⇒ ⊥ s spo t | K =⇒ s spo t | K =⇒ s spo t | K s spo t | K =⇒ ⊥ x spo t | K =⇒ ⊥ s spo x | K =⇒ s = f (s1 , . . . , sm ) spo g(t1 , . . . , tn ) = t | K =⇒ s1 spo t | K ∨ . . . ∨ sm spo t | K ∨ (s q t | K ∧ s spo t1 | K ∧ . . . ∧ s spo tn | K) ∨ (s Q t | K ∧ {s1 , . . . , sm } spo {t1 , . . . , tn } | K)

if if if if

K is false s≡t s ≡ t K is false

if s ≡ x ∈ V ars(s)

where {s1 , . . . , sm } spo {t1 , . . . , tn } | K is translated into a decorated ordering constraint over spo and spo . As for the case of (non-constrained) rewriting, it is easy to see that these transformation rules are correct, terminating and conﬂuent. Moreover, the resulting normal form is a decorated ordering constraint over q and Q . Then after computing the disjunctive normal form, the initial constraint CSP O has been translated into a disjunction of constraints over q and Q each one of the form CQ :

s1 q t1 | K1 ∧ . . . ∧ sp q tp | Kp ∧ s1 Q t1 | Kp+1 ∧ . . . ∧ sq Q tq | Kq

where none of the terms are variables. Note that all Kj coincides with some of the Ki coming from the rules R (i.e., no new constraints are generated). Now, as for the non-decorated case, we have to ﬁnd a reduction triplet satisfying CI and one of these decorated constraints CQ . Theorem 9. Let R be a set of constrained rules and let CI be the constraint containing li I ri | Ki for every constrained rule li → ri | Ki ∈ R, and let 1 k ∪ ... ∪ CQ be the disjunction of decorated ordering constraints over q and Q CQ obtained by applying the MSPO constraint method for constrained termination. Then the set of constrained rules R is terminating iﬀ some decorated reduction i

is satisﬁable. constraint CI , CQ In particular, for innermost termination, we have the following corollary. Corollary 2. Let R be a TRS and let Ri be the set of constrained rules l i r | K i (l) for every l → r ∈ R. Then R is innermost terminating iﬀ CI , CQ

is i satisﬁable for some decorated reduction constraint CI , CQ obtained by applying the MSPO method to Ri . Now, as seen for (non-constrained) rewriting, in order to prove termination we i have to show that some decorated reduction constraint CI , CQ

is satisﬁable. All

40

C. Borralleras and A. Rubio

transformations known for non-decorated constraints can also be used for transforming decorated reduction constraints, although, in some cases, the transformation can be improved by using the additional information of the decorated pairs (see [Bor03] for details).

7

Higher-Order Rewriting

In this section we extend the results on ﬁrst-order rewriting to the higher-order case. The aim of this section is to show the generality of our approach and how simple is to extend it to other kind of rewriting. Due to the lack of room we will present a very simple form of the monotonic higher-order semantic path ordering. Moreover, we will consider a very simple type system, which is enough to present our ideas. See [JR07, BR01] for more powerful versions. 7.1

Types, Signatures and Terms

We consider terms of a simply typed lambda-calculus generated by a signature of higher-order function symbols. The set of types T is generated from the set VT of type variables (considered as sorts) by the constructor → for functional types in the usual way. As usual, → associates to the right. In the following, we use α, β for type variables and σ, τ, ρ, θ for arbitrary types. A signature F is a set of function symbols which are meant to be algebraic operators, equipped with a ﬁxed number n of arguments (called the arity) of respective types σ1 ∈ T, . . . , σn ∈ T, and an output type σ ∈ T. A type declaration for a function symbol f will be written as f : σ1 × . . . × σn → σ. Type declarations are not types, although they are used for typing purposes. The set T (F , X ) of raw algebraic λ-terms is generated from the signature F and a denumerable set X of variables according to the grammar rules T := X | (λX : T.T ) | @(T , T ) | F(T , . . . , T ). Terms of the form λx : σ.u are called abstractions, while the other terms are said to be neutral. For sake of brevity, we will often omit types. @(u, v) denotes the application of u to v. The application operator is allowed to have a variable arity. As a matter of convenience, we may write @(u, v1 , . . . , vn ) for @(@(. . . @(u, v1 ) . . .), vn ), assuming n ≥ 1. 7.2

Typing Rules

Typing rules restrict the set of terms by constraining them to follow a precise discipline. Environments are sets of pairs written x : σ, where x is a variable and σ is a type. Our typing judgments are written as Γ M : σ if the term M can be proved to have the type σ in the environment Γ with the following type system Variables: x:σ∈Γ Γ x:σ

Functions: f : σ1 × . . . × σn → σ ∈ F Γ t 1 : σ1 . . . Γ t n : σn Γ f (t1 , . . . , tn ) : σ

Orderings and Constraints: Theory and Practice of Proving Termination Abstraction: Γ ∪ {x : σ} t : τ Γ (λx : σ.t) : σ → τ

7.3

41

Application: Γ s:σ→τ Γ t:σ Γ @(s, t) : τ

Higher-Order Rewriting and Termination

The rewrite relation considered in this paper is the union of the one induced by a set of higher-order rewrite rules and the β-reduction rule @(λx.v, u) −→β v{x → u}, both working modulo α-conversion. For simplicity reasons, in this work we do not consider η-reduction, although all results can be extended to include it. A higher-order term rewrite system is a set of rewrite rules R = {Γ li → ri }i , where li and ri are higher-order terms such that li and ri have the same type σi in the environment Γ . Given a term rewriting system R, a term s rewrites to a term t at position p p with the rule Γ l → r and the substitution γ, written s −→ t, or simply l→r

s →R t, if s|p = lγ and t = s[rγ]p (modulo α-conversion). Higher-order reduction orderings are basically reduction orderings (monotonic, stable under substitutions and well-founded) operating on typed higher-order terms and including β-reduction. A higher-order rewrite system R is terminating if there is a higher-order reduction ordering such that l r for all rules l → r in R. 7.4

The Higher-Order Semantic Path Ordering (HOSPO)

From now on, to ease the reading, we will omit the environments in judgments. Deﬁnition 14. Given a compatible ordering pair on higher-order typed terms Q , q (where none of Q and q needs to include β-reduction), the HOSPO, denoted as hspo , is deﬁned as s : τ hspo t : τ iﬀ 1. f ∈ F, s = f (s1 , . . . , sm ) and si hspo t, for some i = 1, . . . , m, or 2. f, g ∈ F,s = f (s1 , . . . , sm ) q t = g(t1 , . . . , tn ) and for all i = 1, . . . , n, either s hspo ti or sj hspo t for some j = 1, . . . , m, or 3. f, g ∈ F, s = f (s1 , . . . , sm ) Q t = g(t1 , . . . , tn ) and {s1 , . . . , sm } hspo {t1 , . . . , tn }, or 4. f ∈ F, s = f (s1 , . . . , sm ), t = @(t1 , . . . , tn ), and for all i = 1, . . . , n, either s hspo ti or sj hspo t for some j = 1, . . . , m, or 5. s = @(s1 , s2 ), t = @(t1 , t2 ), {s1 , s2 } hspo {t1 , t2 }, or 6. s = λx.u, t = λx.v, u hspo v, or 7. s = @(λx.u, v) and u{x → v} hspo t where hspo is deﬁned as hspo ∪ α-conversion. Deﬁnition 15. Let I , Q , q be a reduction triplet on higher-order typed terms. The monotonic higher-order semantic path ordering (MHOSPO), denoted by mhspo , is deﬁned as s mhspo t if and only if s I t and s hspo t

42

C. Borralleras and A. Rubio

Theorem 10. mhspo is a higher-order reduction ordering. Finally we show how to translate a MHOSPO termination proof into a (higherorder) reduction constraint problem C1 , C2 . The constraint C1 is obtained as before from I . To obtain C2 we use the deﬁnition of HOSPO. This is formalized by means of correct constraint transformation rules like (we only outline the ones that are diﬀerent from those in 5.2): s = f(s1 , . . . , sm ) hspo g(t1 , . . . , tn ) = t =⇒ hspo t ∨ si :τ si (s q t ti :τ (s hspo ti ∨ sj :τ sj hspo ti )) ∨ (s Q t ∧ {s1 , . . . , sm } hspo {t1 , . . . , tn }) s = f(s1 , . . . , sm ) hspo@(t1 , . . . , tn ) = t =⇒ ti :τ (s hspo ti ∨ sj :τ sj hspo ti ) .. . But, note that, due to the type conditions, the transformation rule s hspo x =⇒ if s ≡ x ∈ V ars(s) does not hold in general, and hence there might be terms on the right hand side of literals in C2 being a variable. Example 2. Filter. To make it simpler we only consider a type variable α. Let VT = {α}, X = { x, xs : α, P : α → α } and F = {[] : α, cons : α × α → α, T rue, F alse : α, f ilter : (α → α) × α → α, if f il : α × (α → α) × α × α → α} f ilter(P, []) → [] f ilter(P, cons(x, xs)) → if f il(@(P, x), P, x, xs) if f il(T rue, P, x, xs) → cons(x, f ilter(P, xs)) if f il(F alse, P, x, xs) → f ilter(P, xs) The constraint C1 is obtained as before: f ilter(P, []) I [] ∧ f ilter(P, cons(x, xs)) I if f il(@(P, x), P, x, xs) ∧ if f il(T rue, P, x, xs) I cons(x, f ilter(P, xs)) ∧ if f il(F alse, P, x, xs) I f ilter(P, xs) and as one of the constraints for C2 we have: f ilter(P, cons(x, xs)) q if f il(@(P, x), P, x, xs) ∧ if f il(T rue, P, x, xs) q cons(x, f ilter(P, xs)) ∧ if f il(T rue, P, x, xs) Q f ilter(P, xs) ∧ if f il(F alse, P, x, xs) Q f ilter(P, xs) Now using the precedence transformation and then the renaming transformation we obtain F ilter(P, cons(x, xs)) q If f il(@(P, x), P, x, xs) ∧ If f il(T rue, P, x, xs) Q F ilter(P, xs) ∧ If f il(F alse, P, x, xs) Q F ilter(P, xs) Finally, the reduction constraint is solved by taking I =Q and q as the strict part of Q , which is deﬁned by a simple polynomial interpretation like |nil| = 0; |cons(x1 , x2 )| = x2 + 1; |f ilter(x1 , x2 , x3 )| = x3 ; |if f il(x1 , x2 , x3 , x4 )| = x4 +1; |F ilter(x1 , x2 , x3 )| = x3 ; |If f il(x1 , x2 , x3 , x4 )| = x4 .

Orderings and Constraints: Theory and Practice of Proving Termination

8

43

Conclusions and Future Work

Termptation (available at http://www.lsi.upc.es/~albert) is a fully automated system for proving termination of ﬁrst-order term rewrite systems which follows the termination proof techniques described in this paper. The current implementation of the system has to be improved in several ways. On the one hand, by incorporating the state of the art techniques for solving reduction constraints. On the other hand, by extending the system to handle other reduction strategies, as well as AC-rewriting, CS-rewriting and HO-rewriting. We are especially interested in the HO-case, since we consider that it is a diﬃcult case were our working program of developing theory at the level of orderings and practice at the level of constraints may be the right one to build a powerful termination tool.

References [AG00]

Arts, T., Giesl, J.: Termination of term rewriting using dependency pairs. Theoretical Computer Science 236(1-2), 133–178 (2000) [BFR00] Borralleras, C., Ferreira, M., Rubio, A.: Complete monotonic semantic path orderings. In: McAllester, D. (ed.) Automated Deduction - CADE17. LNCS, vol. 1831, pp. 346–364. Springer, Heidelberg (2000) [Bor03] Borralleras, C.: Ordering-based methods for proving termination automatically. PhD thesis, Dpto. LSI, Universitat Polit`ecnica de Catalunya (2003) [BR01] Borralleras, C., Rubio, A.: A monotonic higher-order semantic path ordering. In: Nieuwenhuis, R., Voronkov, A. (eds.) LPAR 2001. LNCS (LNAI), vol. 2250, pp. 531–547. Springer, Heidelberg (2001) [BR03] Borralleras, C., Rubio, A.: Monotonic AC-compatible semantic path orderings. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706, pp. 279– 295. Springer, Heidelberg (2003) [FGK02] Fissore, O., Gnaedig, I., Kirchner, H.: CARIBOO: An Induction Based Proof Tool for Termination with Strategies. In: Proc. 4th Int. Conf. on Principles and Practice of Declarative Programming, pp. 62–73. ACM Press, New York (2002) [GTSK04] Giesl, J., Thiemann, R., Schneider-Kamp, P.: The dependency pair framework: Combining techniques for automated termination proofs. In: Baader, F., Voronkov, A. (eds.) LPAR 2004. LNCS (LNAI), vol. 3452, pp. 301–331. Springer, Heidelberg (2005) [GTSKF06] Giesl, J., Thiemann, R., Schneider-Kamp, P., Falke, S.: Mechanizing and improving dependency pairs. J. Autom. Reasoning 37(3), 155–203 (2006) [HM05] Hirokawa, N., Middeldorp, A.: Automating the dependency pair method. Information and Computation 199(1-2), 172–199 (2005) [JR07] Jouannaud, J.-P., Rubio, A.: Polymorphic higher-order recursive path orderings. Journal of the ACM, 54(1) (2007) [KL80] Kamin, S., Levy, J.J.: Two generalizations of the recursive path ordering. Dept. of Computer Science, Univ. of Illinois, Urbana, IL (1980) [vdP98] van de Pol, J.: Operational semantics of rewriting with priorities. Theoretical Computer Science 200(1-2), 289–312 (1998)

Narrowing, Abstraction and Constraints for Proving Properties of Reduction Relations Isabelle Gnaedig1 and H´el`ene Kirchner2 1 2

INRIA & LORIA CNRS & LORIA

Abstract. We describe in this paper an inductive proof method for properties of reduction relations. The reduction trees are simulated with proof trees generated by narrowing and an abstraction mechanism. While narrowing simulates reduction, abstraction relies on the induction principle to replace subterms by variables representing speciﬁc reduced forms that trivially satisfy the property to be proved. The induction ordering is not given a priori, but deﬁned with ordering constraints, incrementally set during the proof. Abstraction constraints are used to control the narrowing mechanism, well-known to easily diverge. The proof method is brieﬂy illustrated on various examples of properties.

1

Introduction

When working with inﬁnite sets in veriﬁcation or theorem proving, several concepts have been proved quite useful: induction, constraints, abstraction, narrowing. Equation solving, inductive theorem proving, deduction with constraints, model checking, abstract interpretations, reachability analysis are a few domains in which they have been introduced as essential features. In particular, they are often used in the context of reduction relations, and especially rewriting relations, that can model many kinds of deduction or computation processes, thanks to the power of rewriting logic [49] and rewriting calculus [9]. We propose in this paper a method that combines these diﬀerent ingredients to prove properties often required for reduction relations. The main idea of the proof principle is to proceed by induction on a wellfounded set with a noetherian ordering , assuming that for any t such that t t , the proposition P holds for t , and then deducing that P holds for t. Unlike classical induction proofs, where the ordering is given, we do not need to deﬁne it a priori. We only have to check its existence by ensuring the satisﬁability of ordering constraints incrementally set along the proof. The class of properties expressed by propositions P that may be handled will be made more precise later on, but in order to support intuition, we can already mention some of them:

UMR 7503 CNRS-INPL-INRIA-Nancy2-UHP. Campus Scientiﬁque, BP 239, 54506 Vandoeuvre-ls-Nancy Cedex, France.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 44–67, 2007. c Springer-Verlag Berlin Heidelberg 2007

Narrowing, Abstraction and Constraints for Proving Properties

45

– termination under a strategy: the proposition P for a given term t is “all S-derivations issued from t terminate”, where a S-derivation is a sequence of rewriting under a strategy S, – weak termination proofs: P is “there is a terminating S-derivation issued from t”, – deﬁnition completeness and existence of constructor forms: P is “there is a derivation issued from t, leading to a constructor form”. Such properties will serve as examples all along this paper to illustrate the diﬀerent notions in our general approach. We rely on our previous works on termination under the innermost [18], outermost [19], and local strategies [17], weak termination under the innermost strategy [20] and existence of constructor forms [26]. Further examples are being explored and may give an idea of other ways to apply the proof method for diﬀerent properties: – (weak-)reducibility of requests to speciﬁc answers: for any given ground term t headed by a deﬁned symbol, “t has a derivation leading to a constant in a given set”, – termination of probabilistic rewriting: for a given t, “the average length of probabilistic derivations issued from t is ﬁnite”, – termination of a transition system: for a given initial state s, “all transition sequences starting from s terminate”. Some of these properties may be or have been proved with alternative methods, which are based for instance on automata techniques for reachability problems, or on reduction orderings or dependency pairs for termination. For properties like termination under the outermost strategy, weak termination, or reducibility to a constructor form when the reduction relation does not terminate, to our knowledge, our approach is the ﬁrst one to provide a proof technique. The paper is organized as follows: after introducing the background in Section 2, we present in Section 3 the inductive proof principle of our approach. Section 4 develops the basic concepts of the inductive proof mechanism based on abstraction and narrowing, and the involved constraints. Section 5 presents the proof procedure and states the general theorem with its conditions of application. Section 6 shows how the proof of a weak property with this method also provides a way to constructively select interesting derivations. Applicability of the approach and related work are addressed in Section 7 and 8 respectively.

2

The Background

We assume the reader familiar with the basic deﬁnitions and notations of algebras and term rewriting given for instance in [2,15,14,4]. For simpler notations, we only consider here unsorted terms, but the framework could be generalized to order-sorted signatures as deﬁned for instance in [29,50].

46

I. Gnaedig and H. Kirchner

Abstract Reduction Systems. An abstract reduction system (M, →) is given by a set and a reduction relation →⊆ M×M. A derivation is a chain of elements a1 → a2 → . . . an ; a1 and an are respectively called the source and the target of the derivation. The element a is irreducible iﬀ there exist no b such that a → b. Terms, Substitutions, Instantiations. T (F , X ) is the set of terms built from a ﬁnite set F of function symbols f with arity n ∈ N (denoted f : n), and a set X of variables denoted x, y . . .. V ar(t) is the set of variables of the term t. T (F ) is the set of ground terms (without variables). Symbols of arity 0 are called constants. Positions in a term are represented as sequences of integers. The empty sequence denotes the top position. Let p and p be two positions. The position p is a (strict) preﬁx of p (and p suﬃx of p) if p = pλ, where λ is a (non-empty) sequence of integers. If p is a position in t, then t[t ]p denotes the term obtained from t by replacing the subterm at position p by the term t . A substitution is an assignment from X to T (F , X ), written σ = (x → t) . . . (y → u). It uniquely extends to an endomorphism of T (F , X ). The result of applying σ to a term t ∈ T (F , X ) is written σ(t) or σt. The domain of σ, denoted Dom(σ) is the ﬁnite subset of X such that σx = x. Id denotes the identity substitution. The composition of substitutions σ1 followed by σ2 is denoted σ2 ◦ σ1 or simply σ2 σ1 . An (A-)instantiation is an assignment θ from X to an F -algebra A, which extends to terms by setting θ(f (t1 , . . . , tn )) = fA (θ(t1 ), . . . , θ(tn )), where fA denotes the interpretation of f in A. An F -equality is an unoriented pair of terms of T (F , X ). A set E of F -equalities deﬁnes a congruence relation on terms denoted =E . The Esubsumption ordering on terms is deﬁned as follows: t ≤E t if there exists a substitution σ such that t =E σ(t). The relations =E and ≤E are extended to substitutions. An E-uniﬁer of two terms t and t is a substitution σ such that σ(t) =E σ(t ). A complete set of E-uniﬁers of t and t is denoted CSUE (t, t ). When E is empty, the CSUE (t, t ) has at most one element, called most general uniﬁer (mgu) when it exists. Orderings. An ordering on T (F , X ) (and more generally on a set M) is noetherian iﬀ there is no inﬁnite decreasing chain for this ordering. It is monotone iﬀ for any pair of terms t, t of T (F , X ), for any context f (. . . . . .), t t implies f (. . . t . . .) f (. . . t . . .). It has the subterm property iﬀ for any t of T (F , X ), f (. . . t . . .) t. It is stable by substitution iﬀ for every substitution σ, t t implies σt σt . For F and X ﬁnite, if is monotone and has the subterm property, then it is noetherian [43]. Rewriting. A set R of rewrite rules is a set of pairs of terms of T (F , X ), denoted l → r, such that l ∈ X and V ar(r) ⊆ V ar(l). In this paper, we only consider ﬁnite sets of rewrite rules. The rewriting relation induced by R is denoted by →R (→ if there is no ambiguity on R), and deﬁned by s → t iﬀ there is a substitution σ and a

Narrowing, Abstraction and Constraints for Proving Properties

47

position p in s such that s|p = σl for some rule l → r of R, and t = s[σr]p . This t where either p, l → r, σ or R may be omitted; s|p is is written s →p,l→r,σ R called a redex. The reﬂexive transitive closure of the rewriting relation induced ∗ by R is denoted by →R . In the rewriting context, the set of function symbols is often split into a set C of constructors and a set D of deﬁned functions. C and D are either arbitrarily given, or deﬁned w.r.t. the rewrite system R: a function symbol is a constructor iﬀ it does not occur in R at the top position of a left-hand side of rule, and a deﬁned function symbol otherwise. A constructor term is a term built only with constructors. The notion of strategy is fundamental for rewriting and can be deﬁned in a general way, slightly diﬀerent from the one used in [4]: a rewrite strategy S for the rewrite system R is a subset of the set of all derivations of R. The application of a strategy S on a term t is denoted S(t) and deﬁned as the set of the targets t of all derivations of source t in S. When a rewrite step belongs to a derivation of the strategy S, it is denoted by →S . A strategy could be described extensively or more suitably by a strategy language like in ELAN [40] Stratego [57], Tom [52,3] or more recently Maude [11] The semantics of such a language is naturally described in the rewriting calculus [9,10]. A strategy language involves rules as basic elements and oﬀers strategy combinators and iterators to build more complex strategy expressions. Well-known rewriting strategies allow controlling the application of rules over subterms, performing term traversal and normalizing terms: in this paper, we consider in particular the innermost, outermost and local strategies on operators whose deﬁnitions can be found in [27] and in [52]. For any term of a term algebra, t terminates (under the strategy S) iﬀ every ∗ rewriting derivation (under the strategy S) starting from t is ﬁnite. If t → t and t is irreducible (under the strategy S), then t is called a normal form of t (under the strategy S). Remark that given t, its normal form (under the strategy S) may be not unique. A rewrite theory on T (F , X ) is a triple (F , E, R) where E is a ﬁnite set of equalities and R a ﬁnite set of rewrite rules. The relation →R/E on T (F , X ) is the sequential composition of relations =E ; →R ; =E . It induces a relation →R/E on the quotient algebra T (F )/ =E by [t]E →R/E [t ]E iﬀ t →R/E t . The relation →R,E on T (F , X ) is deﬁned by s →R,E t iﬀ there is a substitution σ and a position p in s such that s|p =E σl for some rule l → r of R, and t = s[σr]p . Narrowing. Let R be a rewrite system on T (F , X ). A term t is narrowed into t , at the non-variable position p, using the rewrite rule l → r of R and the substitution σ, when σ is a most general uniﬁer of t|p and l, and t = σ(t[r]p ). t where either p, l → r, σ or R may be omitted. It This is denoted t p,l→r,σ R is always assumed that there is no variable in common between the rule and the term, i.e. that V ar(l) ∩ V ar(t) = ∅. Assuming that E has a ﬁnitary complete uniﬁcation algorithm, the narrowing relation R,E on T (F , X ) is deﬁned by

48

I. Gnaedig and H. Kirchner

t p,l→r,σ t iﬀ there exist a non-variable position p, a rewrite rule l → r of R R,E and a substitution σ ∈ CSUE (t|p , l), and t = σ(t[r]p ). In this paper, the sets M of interest are F -algebras A, and in particular the terms algebras T (F ), T (F )/ =E and T (F , X ). The reduction relations → are the rewriting relations →R , →R/E , →R,E , rewriting relations according to strategies (innermost, outermost, local), or the narrowing relations R , R,E .

3

The Inductive Proof Process

From now on, we assume that the set M is non empty and that there is a noetherian ordering deﬁned on elements of M. For proving the proposition P for any element t of M, we proceed by induction on M with the ordering as noetherian induction relation, assuming that for any t such that t t , the proposition P holds for t . 3.1

P -Canonical Forms

All properties addressed in this paper can be expressed by propositions P involving the reduction relation → and speciﬁc elements of M characterized by a decidable property: for termination proofs, this is the property of irreducibility w.r.t the reduction relation, for completeness proofs, this is the syntactic property to be built only with constructors. We distinguish those particular elements of M by calling them P -canonical elements. Then a strong proposition is stated on any given element t of M as: on every derivation of source t, there is a P canonical element, while a weak proposition is: there is a derivation of source t having a P -canonical element. This leads to the deﬁnition of P -canonical form of an element. Deﬁnition 1. Let (M, →) be an abstract reduction system, P a proposition to be proved on M and T ⊆ M a decidable set of P -canonical elements. A P canonical form t⇓ of a term t is an element of T belonging to a derivation of source t. 3.2

Covering Patterns and Simulation

Our goal is to inductively prove a proposition P on M. For that, we simulate (M, →) with another abstract system (N , ), by establishing a correspondence between the elements of M and N and between the reduction relations → and . In the following, we choose for N the set of terms with variables T (F , X ). Let us ﬁrst deﬁne a set of patterns which are ﬂat terms, i.e. terms of the form f (x1 , . . . , xn ) with f ∈ F. We relate patterns to elements of M by considering all their possible instantiations θ(f (x1 , . . . , xn )). More generally, for a term u with variables, we denote by u the set {θ(u) | θ ∈ Φ} where Φ is the set of all instantiations of T (F , X ) into M. This deﬁnition extends to set of terms U = {u1 , . . . , uk } in the following way: U = { u1 , . . . , uk }.

Narrowing, Abstraction and Constraints for Proving Properties

49

Then the correspondence between the reduction relations → and is expressed with a simulation. According to the property to be proved, from a given term, only relevant reduction steps have to be considered. For example, for strong proposition statements, the set of P -relevant reduction steps from a term is the set of all reduction steps from this term. For weak proposition statements, the set of P -relevant reduction steps from a term is reduced to any reduction step from the term. Deﬁnition 2 (P -simulation). Let (M, →) and (N , ) be two abstract reduction systems. (N , ) is a P -simulation of (M, →) iﬀ there is a relation L ⊆ N × M, such that for every P -relevant reduction step a1 → a2 , with a1 , a2 ∈ M, there is a corresponding reduction step b1 b2 , with b1 , b2 ∈ N , and b1 La1 , b2 La2 . 3.3

Lifting Rewriting Trees into Proof Trees

Let us now observe the derivation tree of → starting from an element t ∈ M which is any instance of a term f (x1 , . . . , xm ) for some function symbol f ∈ F, and variables x1 , . . . , xm . This derivation tree is simulated, using a lifting mechanism, by a proof tree, developed from f (x1 , . . . , xm ) on T (F , X ), by alternatively using two main operations, namely narrowing and abstraction, adapted to the property to be proved and to the considered reduction relation. Narrowing simulates the reduction possibilities of elements of M, according to the instances of the narrowed terms. The abstraction process simulates sequences of reductions steps in the derivations, which are valid under the induction hypothesis. More precisely, it consists of replacing subterms by special variables, denoting any of their P -canonical forms, without computing them. It is performed on subterms whose instances can be assumed to satisfy the proposition P by induction hypothesis. The schematization of derivation trees is achieved through constraints. Each node of the developed proof trees is composed of a current term of T (F , X ) and a constraint progressively built along the successive abstraction and narrowing steps. A node schematizes the set of elements of M given by the instantiations of the current term, that are solutions of the constraint. The constraint is in fact composed of two kinds of formulas: ordering constraints, set to warrant the validity of the inductive steps, and abstraction constraints combined to narrowing substitutions, which eﬀectively characterize sets of elements of M. The latter are actually useful for controlling the narrowing process, well known to easily diverge. 3.4

The Overall Mechanism

Let us now consider a proof tree whose root is the pattern f (x1 , . . . , xm ) and see how we can schematize the reduction relation on instances of f (x1 , . . . , xm ), with abstraction and narrowing applied on a current term t of the proof tree:

50

I. Gnaedig and H. Kirchner

– ﬁrst, some subterms tj of the current term t of the proof tree are selected: if θf (x1 , . . . , xm ) θtj for the induction ordering and for every θ solution of the constraint associated to t, we may suppose, by induction hypothesis, that the θtj satisfy the proposition P . The tj are then replaced in t by abstraction variables Xj representing respectively any of their P -canonical forms tj ⇓. Reasoning by induction allows us to suppose the existence of the tj ⇓ without explicitly computing them; – second, narrowing the resulting term u = t[Xj ]j∈{i1 ,...,ip } (where i1 , . . . , ip are the positions of the abstracted subterm tj in t) into terms v, according to the possible instances of the Xj . In general, the narrowing step of u is not unique, but we consider a set of narrowing steps simulating the relevant reductions of the instantiations of u (characterized by the constraint associated to u). Then the problem of proving P on the instantiations of t is reduced to the problem of proving P on the instantiations of v. If θf (x1 , . . . , xm ) θv for every instantiation θ solution of the constraint associated to v, by induction hypothesis, θv is supposed to satisfy P . Otherwise, the process is iterated on v, until getting a term t such that either θf (x1 , . . . , xm ) θt , or θt satisﬁes P . The proof procedure given in this paper is described by deduction rules applied with a special control Strat −Rules, that depends on the studied reduction relation, and on the proposition to be proved. Applying the deduction rules, according to the strategy, to the initial term f (x1 , . . . , xm ) builds a proof tree. Branching is produced by the diﬀerent possible narrowing steps. The proposition P is established when the procedure terminates because the deduction rules do not apply anymore and all terminal nodes of all proof trees represent terms satisfying P .

4

Abstraction, Narrowing, and the Involved Constraints

Let us now formalize the concepts required for our technique, and illustrate them with some particular cases. 4.1

Ordering Constraints

The induction ordering is constrained along the proof by imposing constraints between terms that must be comparable, each time the induction hypothesis is used in the abstraction mechanism. So inequalities of the form t > u1 , . . . , um are accumulated and are called ordering constraints. Deﬁnition 3 (ordering constraint). An ordering constraint is a pair of terms of T (F , X ) denoted by (t > t ). It is satisﬁable if there is an ordering , such that for every instantiation θ whose domain contains Var (t) ∪ Var (t ), we have θt θt . Then we say that satisﬁes (t > t ). A conjunction C of ordering constraints is satisﬁable if there is an ordering satisfying all conjuncts. The empty conjunction, always satisﬁed, is denoted by .

Narrowing, Abstraction and Constraints for Proving Properties

51

As we are working with a lifting mechanism on the proof trees with terms of T (F , X ), we directly work with an ordering N on T (F , X ) such that t N u implies on M that θt θu, for every θ solution of the constraint associated to u. Any ordering N on T (F , X ) satisfying the above constraints and which is stable by instantiation fulﬁlls the previous requirements on M. For convenience, the ordering N is also written . Satisﬁability of a constraint conjunction C of the above form is undecidable in general. But a suﬃcient condition is to ﬁnd an ordering on T (F , X ) which is stable by instantiation and such that t t for any constraint t > t of C. When M is T (F ), we often try to solve the constraints of C by ﬁnding simpliﬁcation orderings. This is a well-known problem in rewriting. The simplest and most automatable way to proceed is to test simple existing orderings like the subterm ordering, the Recursive Path Ordering, or the Lexicographic Path Ordering. This is often suﬃcient for the constraints considered here: thanks to the power of induction, they are often simpler than for termination methods directly using orderings for orienting rewrite rules. If these simple orderings are not powerful enough, automatic solvers like Cime 1 can provide adequate polynomial orderings. 4.2

Abstraction

To abstract a term t at positions j ∈ {i1 , . . . , ip }, we assume that the t|j are such that every instantiation θt|j veriﬁes the proposition P . It then reduces to a P -canonical form θt|j ⇓, and we replace the t|j by abstraction variables Xj representing respectively any of these possible P -canonical forms. Let us deﬁne these special variables more formally. Deﬁnition 4. Let XA be a set of variables disjoint from X . Symbols of XA are called abstraction variables. Instantiations are extended to T (F , X ∪ XA ) in the following way: for any instantiation θ such that Dom(θ) contains a variable X ∈ XA , θX is a P -canonical form. Deﬁnition 5 (term abstraction). The term t[t|j ]j∈{i1 ,...,ip } is abstracted into the term u (called abstraction of t) at positions {i1 , . . . , ip } iﬀ u = t[Xj ]j∈{i1 ,...,ip } , where the Xj , j ∈ {i1 , . . . , ip } are fresh distinct abstraction variables. Term abstraction may involve restrictions related to the choice of abstraction positions according to the proposition P and the reduction relation →. This is the case for instance for termination proofs under the outermost strategy, where i is an abstraction position only if there is no redex at preﬁx positions of i. The proposition P is proved by reasoning on terms with abstraction variables, i.e. in fact on terms of T (F , X ∪ XA ). Ordering constraints are extended to pairs of terms of T (F , X ∪ XA ). When subterms t|j are abstracted by Xj , we state constraints on abstraction variables, called abstraction constraints, to express 1

Available at http://cime.lri.fr/

52

I. Gnaedig and H. Kirchner

that their instantiations can only be P -canonical forms of the corresponding instantiations of t|j . Initially, they are of the form t⇓ = X where t ∈ T (F , X ∪XA ), and X ∈ XA , but we will see later how they are combined with the substitutions used for the narrowing process. 4.3

Narrowing

After abstraction of the current term t into t[Xj ]j∈{i1 ,...,ip } , we check whether the possible instantiations of t[Xj ]j∈{i1 ,...,ip } are reducible, according to the possible values assigned to the Xj . This is achieved by narrowing t[Xj ]j∈{i1 ,...,ip } . To simulate the reduction relation on M, a speciﬁc narrowing relation is chosen in such a way that (T (F , X ∪ XA ), ) is a P -simulation of (M, →). Let us give examples of such simulations. In these examples, the relation L used in Deﬁnition 2 is the (E-)subsumption ordering ≤, possibly with restrictions expressed via the constraints. The Case of Rewriting Under Strategies. Let (M, →) be (T (F ), →S ). The narrowing relation depends on the considered strategy S and the usual deﬁnition needs to be reﬁned. First, in the innermost and outermost cases, to ensure P -simulation, an Snarrowing redex in t must correspond to an S-rewriting redex in a ground instance of t. This is the case only if, in the rewriting chain of the ground instance of t, there is no rewriting redex anymore in the part of the term brought by the instantiation. In the innermost case, this condition is fulﬁlled thanks to normalized instances of abstraction variables. In the outermost case, the condition is ensured by a variable renaming performed before narrowing [27]. Then, among the ground instances of t, there may be innermost (resp. outermost) rewriting positions p for some instances, and p for some other instances, such that p is a suﬃx (resp. a preﬁx) of p. So, when narrowing at some position p, the set of corresponding ground instances of t is deﬁned by excluding the ground instances that would be narrowable at some suﬃx (resp. preﬁx) position p of p. These positions p are said S-better than p. The narrowing steps of a given term t are thus computed in the following way. After applying the variable renaming to t, we look at every non-variable position p of t such that t|p uniﬁes with the left-hand side of a rule using a substitution σ. The position p is a narrowing position of t, iﬀ there is no S-better position p of t such that σt|p uniﬁes with a left-hand side of rule. Then we look for every S-better position p than p in t such that σt|p narrows with some substitution σ and some rule l → r , and we set a constraint to exclude these substitutions. So the substitutions used to narrow a term have in general to satisfy a set of disequalities coming from the negation of previous substitutions. To formalize this point, we need the following notations and deﬁnitions. In the following, we identify a substitution σ = (x1 → t1 ) . . . (xn → tn ) on T (F , X ∪ XA ) with the ﬁnite set of solved equations (x1 = t1 ) ∧ . . . ∧ (xn = tn ), also denoted by the equality formula i (xi = ti ), with xi ∈ X ∪ XA , ti ∈

Narrowing, Abstraction and Constraints for Proving Properties

53

T (F , X ∪ XA ), where = is the syntactic equality. Similarly, we call negation σ of the substitution σ the formula i (xi = ti ). Deﬁnition 6 (constrained substitution). [27] A constrained substitution σ is a formula σ0 ∧ j ij (xij = tij ), where σ0 is a substitution. This leads to an adapted deﬁnition of narrowing. Deﬁnition 7 (S-narrowing). [27] A term t ∈ T (F , X ∪ XA ) S-narrows into a term t ∈ T (F , X ∪ XA ) at the non-variable position pof t, using the rule l → r ∈ R with the constrained substitution σ = σ0 ∧ j∈[1..k] σj , which is written t Sp,l→r,σ t iﬀ σ0 (l) = σ0 (t|p ) and t = σ0 (t[r]p ) where σ0 is the most general uniﬁer of t|p and l and σj , j ∈ [1..k] are all most general uniﬁers of σ0 t|p and a left-hand side l of a rule of R, for all positions p which are S-better than p in t. The following lifting lemma generalizes [51] and states that (T (F , X ), ) P simulates (T (F ), →S ). Lemma 1 (S-lifting Lemma). [27] Let R be a rewrite system. Let s ∈ T (F , X ), α a ground substitution such that αs is S-reducible at a non variable position p of s, and Y ⊆ X a set of variables such that V ar(s) ∪ Dom(α) ⊆ Y. If αs→Sp,l→r t , then there exist a term s ∈ T (F , X ) and substitutions β, σ = σ0 ∧ j∈[1..k] σj such that: 1. 2. 3. 4.

s Sp,l→r,σ s , βs = t , βσ0 = α[Y] β satisﬁes j∈[1..k] σj

where σ0 is the most general uniﬁer of s|p and l, for j ∈ [1..k] the σj are the most general uniﬁers of σ0 s|p with a left-hand side l of a rule of R, for all positions p which are S-better than p in s. The Case of C-Reducibility. Let (M, →) be (T (F ), →R ). There we need a covering property of the narrowed term by narrowing substitutions (see [26]), and the following lemma. Lemma 2. [26] Let R be a rewrite system, u a term of T (F , XA ), and Σ the set of narrowing substitutions of u for R. If Σ is covering u, then every ground t , for some ground substitution β, instance αu of u is such that αu →p,l→r,βσ R p,l→r,σ v for some v of T (F , XA ), βσ = α on any variable set and we have u R Y ⊇ V ar(u) ∪ Dom(α), and t = βv.

54

I. Gnaedig and H. Kirchner

The Case of Transition Systems. In rewriting logic, a concurrent system is axiomatized as a rewrite theory modulo some equational axioms with system transitions described by rewrite rules. As deﬁned in [50], a topmost rewrite theory is such that E-equivalence classes of ground terms are made of terms of a given sort and rewrite rules l → r are such that l and r are of the same sort. Such rewrite theories specify concurrent systems in Maude. They enjoy a speciﬁc lifting lemma, thanks to the fact that the relations →R/E and →R,E coincide in this context. Lemma 3. [50] For a topmost theory (F , E, R), let t in T (F , X ) be a non variable term and V a set of variables containing Var (t). For some substitution ρ, let ρ(t) →R/E t using the rule l → r in R. Then there are σ, θ, t such that t σR,E t using the same rule l → r, t is not a variable, ρ =E (θ ◦ σ) on V and θ(t ) =E t . 4.4

Cumulating Constraints

Abstraction constraints have to be combined with the narrowing substitutions to characterize the set of elements of M schematized in the proof trees. A narrowing step eﬀectively corresponds to a rewriting step of instantiations of u if the narrowing substitution σ is compatible with the abstraction constraints associated to u. Otherwise, the narrowing step is meaningless. So the narrowing constraint attached to the narrowing step is added to abstraction constraints, to get an abstraction constraint formula (ACF for short). In the case of termination under strategies, the ACF may be a complex formula of the form i (ti ⇓ = ti ) ∧ j (xj = tj ) ∧ k lk (ulk = vlk ), where ti , ti , tj , ulk , vlk ∈ T (F , X ∪ XA ), xj ∈ X ∪ XA . For speciﬁc deﬁnitions of an ACF and its solutions, see [27,20,26]. An ACF A is attached to each term u in the proof trees; its solutions characterize the interesting instantiations of u, i.e. the θu such that θ is a solution of A. When A has no solution, the current node of the proof tree represents no element of M. Such nodes are then useless for the proof. Detecting and suppressing them when applying a narrowing step allows controlling the narrowing mechanism. So we have the choice between generating only the useful nodes of the proof tree, by testing the satisﬁability of A at each step, or stopping the proof on a branch on an useless node, by testing the unsatisﬁability of A. These are both facets of the same question, but in practice, they are handled in diﬀerent ways. Checking the satisﬁability of A is in general undecidable, but suﬃcient conditions can be given, relying on a characterization of P -canonical forms. The unsatisﬁability of A is also undecidable in general, but simple automatable suﬃcient conditions can be used, very often applicable in practice. They rely on reducibility, uniﬁability, narrowing and constructor tests [27]. 4.5

Relaxing the Induction Hypothesis

It is important to point out the ﬂexibility of the proof method that allows the combination with auxiliary proofs of P using diﬀerent techniques: when the

Narrowing, Abstraction and Constraints for Proving Properties

55

induction hypothesis cannot be applied on a term u, i.e. when it is not possible to decide whether the ordering constraints are satisﬁable, it may be possible to prove P for any instantiation of u (which is denoted by P ( u)) by another way. When termination properties are addressed, the notion of usable rules [1], adapted to the case of strategies [27,19,17], can be very useful to prove P . Moreover, P ( u) is true when, in particular, every instantiation of u is a P canonical form. For termination, this is the case when u is not narrowable, and all variables of u are abstraction variables in XA . Indeed, by Deﬁnition 4 and Lemma 1 for weak innermost or S-termination of rewriting, every instantiation of u is a P -canonical form. This includes the cases where u itself is an abstraction variable, and where u is a non narrowable ground term. P is also true on a narrowable u whose variables are all in XA , and whose narrowing substitutions are not compatible with A. As said in Section 4.4, these narrowing possibilities do not represent any reduction step for the instantiations of u, which are then P -canonical forms. For C-reducibility, terms of T (C, XA ) are P -canonical forms.

5 5.1

The Proof Procedure Inference Rules

We are now ready to describe the diﬀerent steps of the proof mechanism presented in Section 3. The proof steps generate proof trees in transforming 3-tuples (T, A, C) where – T is either a singleton containing the current term u of T (F , X ∪ XA ) or the empty set, – A is a conjunction of abstraction constraints. At each abstraction step, constraints of the form u⇓ = X, u ∈ T (F , X ∪ XA ), X ∈ XA are added to A for each subterm u abstracted into a new abstraction variable X. At each narrowing step with narrowing substitution σ, σ is added to A, – C is a conjunction of ordering constraints stated by the abstraction steps. Starting from initial nodes (T = {f (x1 , . . . , xm )}, A = , C = ), with f ∈ F, the proof process consists in applying the inference rules described in Table 1. In these rules, the satisﬁability of A is checked before each narrowing step only. For the abstraction and stop steps, arguments on variables and the application order of the rules allow deducing that the satisﬁability of A is preserved. For details and variants on the conditions of the inference rules, especially with unsatisﬁability test of A, see [27]. 5.2

How to Combine the Inference Rules

The previous inference rules, applied to every pattern p = f (x1 , . . . , xm ), where x1 , . . . , xm ∈ X and f ∈ F, are combined with the following control: Strat −Rules = repeat ∗ (try(abstract ), try−dk (narrow ), try(stop)).

56

I. Gnaedig and H. Kirchner Table 1. Inference rules applied on the pattern p = f (x1 , . . . , xm ) Abstract:

{t}, A, C t|j ⇓ = Xj , C ∧

{u}, A ∧ j∈{i1 ,...,ip }

HC (t|j ) j∈{i1 ,...,ip }

where t is abstracted into u at positions i1 , . . . , ip = if C ∧ HC (t|i1 ) . . . ∧ HC (|tip ) is satisﬁable Narrow:

{t}, A, C {u}, A ∧ σ, C

if t σ u and A ∧ σ is satisﬁable Stop:

{t}, A, C ∅, A ∧ HA (t), C ∧ HC (t)

if (C ∧ HC (t)) is satisﬁable. and HA (t) =

t⇓ = X

HC (t) =

if all instantiations of t are P−canonical forms otherwise.

if P (t) p > t otherwise.

The control strategy ”repeat ∗ (T1 , . . . , Tn )” repeats the control strategies of the list (T1 , . . . , Tn ) until it is not possible anymore. The operator ”try” is a generic operator that can be instantiated, following the given reduction relation, by try−skip(T ), expressing that the strategy or rule T is tried and skipped when it cannot be applied, or by try−stop(T ), stopping the strategy if T cannot be applied. The operator “try−dk is deﬁned like ”try”, but the strategy T has to be applied in all possible ways (which generates branching nodes in the proof trees). This is required to generate all narrowing steps simulating the relevant reductions. 5.3

The General Theorem

Let us assume that the rule Narrow is applied with a narrowing relation such that (T (F , X ∪XA ), ) is a simulation of (M, →). We write SUCCESS (f , , ) if the application of Strat −Rules on ({f (x1 , . . . , xm )}, , ), gives a ﬁnite proof tree, whose sets C of ordering constraints are satisﬁed by a same ordering , and whose leaves are nodes of the form (∅, A, C). The following theorem is stated provided an emptiness lemma, an abstraction lemma, a narrowing lemma and a stopping lemma hold (see below). These lemmas depend on the proposition P , on the set M and on the relations → and , and are established for each case. Theorem 1. Let (M, →) be an abstract reduction system, where M is an F algebra, P be a proposition to be proved on (M, →), and (T (F , X ∪ XA ), ) a

Narrowing, Abstraction and Constraints for Proving Properties

57

P -simulation of (M, →). Let I be the subset of constants of F such that the elements of I are irreducible for →. I is assumed to be non-empty. If – there is a noetherian ordering such that for each f ∈ F \ I, we have SUCCESS (f , , ), – P is true on I, then P is true on M. Proof. By hypothesis, on I, P is true. We may thus restrict our attention to the elements of M \ I, simulated by the patterns f (x1 , ..., xn ). Let us prove that θf (x1 , . . . , xm ) satisﬁes P for any θ satisfying A = if we have SUCCESS (f , , ) for every deﬁned symbol f ∈ F \ I. To each node N of the proof tree of f , characterized by a current term t and the set of constraints A, we associate the set of elements G = {αt | α satisﬁes A}, that is the set of elements of M represented by N . Inference rule Abstract (resp. Narrow) transforms ({t}, A) into ({t }, A ) to which is associated G = {βt | β satisﬁes A } (resp. into ({ti }, Ai ), i ∈ [1..l] to which are associated G = {βi ti | βi satisﬁes Ai }). By Abstraction (resp. narrowing) Lemma, applying Abstract (resp. Narrow), for each αt in G, there is a βt (resp. βi ti ) in G and such that P is true for βt (resp. for the βi ti ) implies P is true for αt. When the inference rule Stop applies on ({t}, A, C), A is satisﬁable, and then, by Stopping Lemma, every element of G = {αt | α satisﬁes A} satisﬁes P . Therefore, the proposition P is true for all terms in all sets G. As the process is initialized with {f (x1 , . . . , xm )} and a constraint problem satisﬁable by any instantiation, we get that θf (x1 , . . . , xm ) satisﬁes P , for any f (x1 , . . . , xm ) and any instantiation θ. The following lemmas are necessary for the proof of Theorem 1 and have to be proved for each instance of P and →. Lemma 4 (Abstraction Lemma). Let ({t}, A, C) be a node of any proof tree, giving the node ({t = t[Xj ]j∈{i1 ,...,ip } }, A , C ) by application of Abstract. For any instantiation α satisfying A, if αt is reducible, there is β such that P is true for βt implies P is true on αt. Moreover, β satisﬁes A . The narrowing lemma has two versions, according to the strong (resp. weak) character of the proposition P to be proved. Lemma 5 (Narrowing Lemma). Let the narrowing relation used in Narrow be such that (T (F , X ∪ XA ), ) is a P -simulation of (M, →). Let ({t}, A, C) be a node of any proof tree, giving the nodes ({vi }, Ai , Ci ), i ∈ [1..l], by application of Narrow. For any instantiation α satisfying A, if αt is reducible, then, for each i ∈ [1..l], there exist βi such that P is true for all (resp. one of ) the βi vi , i ∈ [1..l], implies P is true for αt. Moreover, βi satisﬁes Ai for each i ∈ [1..l]. Lemma 6 (Stopping Lemma). Let ({t}, A, C) be a node of any proof tree with A satisﬁable, and giving the node (∅, A , C ) by application of an inference rule. Then for any instantiation α satisfying A, αt satisﬁes P .

58

5.4

I. Gnaedig and H. Kirchner

An Example

Consider the following rewrite system R, taken from [20], which is not terminating, nor even, because of the rule (2), innermost terminating. f (g(x), s(0)) → f (g(x), g(x)) f (g(x), s(y)) → f (h(x, y), s(0))

(1) (2)

g(s(x)) → s(g(x)) g(0) → 0

(3) (4)

h(x, y) → g(x).

(5)

Let us prove weak innermost termination of R on T (F ), with F = {f : 2, h : 2, g : 1, s : 1, 0 : 0}. Since the deﬁned symbols of R are f , g, and h, we have to apply the inference rules to f (x1 , x2 ), g(x1 ) and h(x1 , x2 ). The proof trees, given in Figure 1 show how the inference rules are applied. When Narrow applies, we specify the narrowing substitution, and in parentheses, the rewrite rule number used to narrow. For weak propositions, when narrowing produces several steps simulating reduction steps for the same set of ground instances, we develop all branches in parallel to increase the chances to get success, i.e. to get branches ending with an application of Stop. As soon as one is successful, the other ones are cut. On the example, the subtree marked by in the proof tree of f is cut as soon as the subtree generated on the left from f (X6 , s(0)) with the same substitution (up to a renaming) σ = (X6 = g(X7 )) ∧ (X7 = s(X8 ) ∧ X7 = 0) is successful. The ﬁnal proof trees are bold.

6

Finding P -Canonical Forms for Weak Properties

When P is a weak proposition, computing a P -canonical form with the reduction relation → in general requires to develop the reduction trees with a breadth-ﬁrst strategy to capture the branch leading to the good elements. But such a strategy is often very costly, and it is much better to have hints about the good derivations to compute them directly with a depth-ﬁrst mechanism. Our proof process, as it simulates the reduction mechanism, gives complete information on the interesting reduction branches. It allows extracting the exact application of reduction that yields an interesting form, like a normal form or a constructor form. The breadth-ﬁrst strategy is used once, for generating the proof trees. Then, to reduce an element, it is enough to follow the reduction scheme simulated by abstraction and narrowing in the proof trees. When M is T (F ) and → a rewriting relation, a P -canonical form for any element of M is computed with a reduction strategy ST that is built according to the proof trees establishing the proposition P . Deﬁnition 8. Let P be a proposition on (T (F ), →) proved using Theorem 1. The strategy tree STf associated to f ∈ F is the proof tree obtained from the initial node ({f (x1 , . . . , xm )}, , ).

Narrowing, Abstraction and Constraints for Proving Properties

h(x1 , x2 )

g(x1 )

Abstract

s(g(X2 ))

Abstract

g(X1 )

mm mmm m m mmm v mm Narrow,(3) m

σ=(X1 =s(X2 ))

59

h(X1 , X2 )

NNN NNσ=(X NNN 1 =0) Narrow,(4) NNN NN'

σ=Id Narrow,(5)

g(X1 )

0

Stop

Stop

Stop

∅

∅

∅

f (x1 , x2 ) Abstract

f (X1 , X2 ) σ = (X1 = g(X3 ) ∧ X2 = s(X4 )) Narrow,(2) ∧(X3 = s(X5 ) ∧ X3 = 0) f (h(X3 , X4 ), s(0))

Abstract

f (X6 , s(0)) σ = (X6 = g(X7 )) SSS jj j SSS j ∧(X7 = s(X8 ) ∧ X7 = j0) j j S

jjjj ujjjj Narrow,(1)

f (g(X7 ), g(X7 ))

SSS SSS S) / f (h(X9 , 0), s(0))

Narrow,(2)

Abstract

Abstract

f (X11 , X12 )

f (X13 , s(0))

w

σ = (X11 = g(X14 ) ∧ X12 = s(X15 )) ww ww w = s(X ) ∧ X = 0) ∧(X 14 16 14 ww ww w f (h(X14 , X15 ), s(0)) ww Narrow,(1)

Narrow,(2)

Stop

∅

ww ww w w w {w

f (g(X17 ), g(X17 ))

Narrow,(2)

f (h(X19 , 0), s(0))

Fig. 1. Example. Proof trees for symbols g, h and f .

The computation of a P -canonical form of any element of T (F ) follows the strategy trees. Deﬁnition 9. Let P be a proposition on (T (F ), →) proved using Theorem 1. Let ST = {STf | f ∈ F } be the set of strategy trees, and s = f (t1 , . . . , tn ) be an

60

I. Gnaedig and H. Kirchner

element of T (F ). Computing a P -canonical form canST (s) with respect to ST is done in the following way: – if f ∈ I, then canST (s) = canST (f ) = f , – else canST (s) is recursively computed as follows: let t be the current term in the recursive deﬁnition and u the corresponding term in STf such that θ(u) = t for some instantiation θ. Then canST (t) = canST (t ), where • if the step applied on u is Abstract, at positions i1 , . . . , ip , t|ij ⇓ if P ( u|ij ) then t = t[t1 ]i1 . . . [tp ]ip , and tj = canST (t|ij ) otherwise, • if the step is Narrow with u p,l→r,σ u , then t = μu , for some μ suchthat θ = μσ on V ar(u) ∪ Dom(θ), t⇓ if P ( u) • if the step is Stop, then t = canST (t) otherwise. The previous deﬁnition assumes that if the proposition P has been proved on a particular element t during the proof, one is able to build a strategy to compute a P -canonical form of t. In the case of weak termination proof for instance, a simple suﬃcient condition is that t is proved strongly terminating, which can be established in most cases with the usable rules of t. Under this assumption, the following theorem has been proved in [20] for the weak innermost termination, and in [26] for existence of constructor forms. Theorem 2. Let P be a proposition on (T (F ), →) proved with Theorem 1. Let ST = {STf | f ∈ F } be the set of strategy trees.Then for every element t ∈ T (F ), canST (t) is a P -canonical form for →. In [20] it is shown how, in the previous weak innermost termination example, Deﬁnition 9 is used to build a strategy for computing a weak normal form for any ground term.

7

Applicability of our Inductive Approach

As witnessed by the spectrum of properties it can prove, our inductive proof method is well-suited to handle properties of reduction relations, and in particular of rewriting relations. In return, the used ingredients are in general delicate to handle: satisﬁability of term ordering constraints is undecidable, as well as satisﬁability of abstraction constraints. Moreover the narrowing process easily diverges. However, in the context where these notions are used, we can deal with them in a reasonable eﬃcient way. Cariboo [18,21], an implementation of our method for termination under the innermost, outermost and local strategies, allowed us to observe how these notions behave in an operational and practical way.

Narrowing, Abstraction and Constraints for Proving Properties

61

Ordering Constraints. Satisﬁability of term ordering constraints can be handled with suﬃcient conditions based on existing orderings. For instance, testing simple orderings as the subterm ordering or a lexicographic path ordering is suﬃcient for more than 80% of the innermost examples treated by Cariboo (most than 200 tested), thanks to the power of induction, and to the help of usable rules. For the other ones, a constraint solver providing polynomial interpretations gives a solution. The failure cases are due to generated ordering constraints whose resolution requires to compare abstraction variables with standard variables, or which cannot be satisﬁed by simpliﬁcation orderings, because of constraints incompatible with term embedding. In the ﬁrst case, additional knowledge on normal forms can solve the problem. For the second case, other orderings must be tried. For C-reducibility, ordering constraints are easier to solve. Indeed, it can be assumed that the constructor terms are minimal for the induction ordering, which allows us to compare abstraction variables with standard variables, and avoids the ﬁrst above failure case. Abstraction Constraints. As said before, simple and easily implementable suﬃcient conditions exist for proving unsatisﬁability of A. Meaningless nodes in proof trees are then automatically detected and the process stops with success on the current branch. Suﬃcient conditions for satisﬁability can also be given, relying on a characterization of P -canonical forms. An obvious solution for an abstraction constraint of the form t⇓ = X is t itself if t is a P -canonical form. Narrowing. Narrowing substitutions, in the same way as abstraction constraints, restrict the considered sets of instantiations in the nodes of the proof trees. As the abstraction formula A, collecting both kinds of restrictions, is proved to be (un)satisﬁable at each step of the proofs, useless narrowing steps are detected and discarded. Moreover, for weak properties, as said before, redundant branches generated by narrowing i.e. branches representing the same sets of ground instances can be detected and cut.

8

Related Work

Several properties considered in our approach are also provable with other methods. A number of works address the termination property for the innermost, context sensitive and lazy rewriting strategies. Suﬃcient completeness has also been investigated for conditional and typed speciﬁcations, in the conﬂuent (every derivation chain from a given element leads to the same form) and terminating case. Let us see more in detail how these works relate to our approach. Innermost Termination. The termination proof for the innermost strategy has also be tackled with the dependency pair method, designed from 1996 by T. Arts and J. Giesl for universal termination of rewriting [1,24,23]. The comparison between this method and our approach is not easy to do. Indeed, several basic ingredients are shared: narrowing, ordering constraints,

62

I. Gnaedig and H. Kirchner

usable rules are present in both contexts. But while the dependency pairs method is initially based on an analysis of the rules syntax to detect forward closures, our approach was guided by the idea to schematize derivation trees, which allows us to abstract the reduction relation. Except for the innermost case, handling speciﬁc rewriting strategies seems more diﬃcult with the dependency pair approach. Simulation by narrowing has been used as the basis of our method, since 1999 [28], to schematize rewriting steps of terms, following their possible ground instances. In the dependency pair approach instead [1], narrowing has been introduced to provide a suﬃcient condition to detect the dependencies between pairs. Usable rules have been introduced in the dependency pair approach [1] for innermost termination. We then have adapted the notion to local strategies [17], and to the outermost strategy [19], to enrich our inductive proof principle. Let us mention another work establishing that orderings suitable for proving innermost termination have to be at least monotonic after each maximal parallel innermost rewriting step [16]. A similar structural requirement is expressed on the induction ordering needed for our inductive approach, through constraints f (x1 , ..., xn ) > xi for function symbols f in patterns. Termination under Local Strategies. Many results have recently be given for termination of the context-sensitive rewriting [45,22,48], which involves particular kinds of local strategies [46,47]. Local strategies, giving ordered lists of positions to be rewritten in a term, are more speciﬁc than context sensitive strategies, where the order of reduced positions is not speciﬁed. They can enable termination while the context sensitive strategy diverges [17]. Outermost Termination. Outermost computations are of interest in particular for functional languages, where interpreters or compilers generally involve a strategy for call by name. Often, lazy evaluation is used instead: operators are labeled in terms as lazy or eager, and the strategy consists of reducing the eager subterms only when their reduction allows a reduction step higher in the term [53]. Termination of lazy evaluation has been studied for functional languages (see for example [55] and [25] for Haskell). A double motivation for studying the outermost computation is that it is simpler to implement and that lazy evaluation may diverge while the outermost computation terminates [19]. Up to our knowledge, there is still no other termination proof method for speciﬁcally proving outermost termination of rewriting. Weak Termination. The weak termination property has been studied from several perspectives. For instance, B. Gramlich proved that weak termination can imply strong termination [31,32] under some syntactic restrictions. He also established conditions on rewrite systems for the property to be preserved by the union operation [33]. J. Goubault-Larrecq proposed a proof of weak termination of typed Lambda-Sigma calculi in [30]. Beyond these works and our’s, we are not aware of other techniques for establishing weak

Narrowing, Abstraction and Constraints for Proving Properties

63

termination of rewriting. Our method even proves weak termination of systems that are not innermost strongly terminating. C-reducibility. Suﬃcient completeness has already been widely studied, for example in [35,54,41,37,12,36,44,6,5,34,7], but most of the time, the proposed approaches for proving the property need restrictions like termination and conﬂuence. Under the last two assumptions, suﬃcient completeness can also be tackled through ground reducibility (expressing that every ground instance of a term is reducible) [56,38,36,42,8,13], provided the normal form of a constructor term is again a constructor term [36]. Our approach for proving C-reducibility goes beyond the previous usual restrictions, proposing for the ﬁrst time a technique for proving the reachability of constructor forms for programs or rewrite systems that can be neither conﬂuent, nor terminating. No restriction on the domain is required, such as the constructor preserving property, or the absence of relation between constructors. Although our method diﬀers from previous approaches, we naturally encounter basic notions already used for proving suﬃcient completeness, as uniﬁcation, used in [44], or covering properties used in many works in the domain, for example in [41,44]. In [5], pattern trees are also developed, but under the assumption that the rewrite system is terminating and ground conﬂuent.

9

Conclusion

In this paper, we have presented an inductive proof method for properties of reduction relations on an abstract reduction system (M, →) where M is an F -algebra. Let us summarize its main characteristics. We handle proofs of a proposition P stating a property by observing the possible derivation trees of the relation →, schematizing them with a narrowing relation on terms. Several examples have been given where M is T (F ) and → various rewrite relations. Other applications are suggested and need further study. Induction with a noetherian ordering on M is used to modelize subderivations leading to a P -canonical form, and to stop derivations as soon as P can be supposed true by induction. The inference process is expressed with three inference steps: an abstraction and a stop step, expressing respectively the above induction mechanisms, and a narrowing step, simulating the reductions on a given term. Constraints are heavily used on one hand to gather conditions that the induction ordering must satisfy, on the other hand to represent the set of instantiations of terms. The power of deduction with constraints [39] is once more illustrated in this proof process. Despite the proof method is strongly based on derivation trees, the induction relation is not the reduction relation, which is then not required to be terminating. Our approach for proving the property of reduction to a constructor form [26] nicely illustrates this fact. An interesting aspect of this technique is that it allows, for weak properties, the identiﬁcation of interesting branches leading to P -canonical forms, like

64

I. Gnaedig and H. Kirchner

normal forms or constructor forms. Their computation is guided by the proof trees of the weak property. How this can be exploited for certifying compilers of rewrite programs needs to be further explored.

References 1. Arts, T., Giesl, J.: Proving innermost normalisation automatically. In: Comon, H. (ed.) Rewriting Techniques and Applications. LNCS, vol. 1232, pp. 157–171. Springer, Heidelberg (1997) 2. Baader, F., Nipkow, T.: Term Rewriting and all That. Cambridge University Press, New York, NY, USA (1998) 3. Balland, E., Brauner, P., Kopetz, R., Moreau, P.-E., Reilles, A.: Tom Manual LORIA, Nancy (France) (version 2.4 edition) (2006) 4. Bezem, M., Klop, J.W., de Vrijer, R.: Term Rewriting Systems. In: Cambridge Tracts in Theoretical Computer Science. Cambridge University Press, Cambridge (2003) 5. Bouhoula, A., Jaquemard, F.: Automatic veriﬁcation of. suﬃcient completeness for. speciﬁcations of complex data structures. Technical Report RR-LSV-05-17, INRIA (2005) 6. Bouhoula, A.: Using induction and rewriting to verify and complete parameterized speciﬁcations. Theoretical Computer Science 170(1-2), 245–276 (1996) 7. Bouhoula, A., Jacquemard, F.: Automating suﬃcient completeness check for conditional and constrained TRS. In: Levy, J (ed): Proceedings of the 20th International Workshop on Uniﬁcation (UNIF’06), Seattle, Washington, USA (August 2006) 8. Caron, A-C., Coquide, J-L., Dauchet, M.: Encompassment properties and automata with constraints. In: Kirchner, C. (ed.) Rewriting Techniques and Applications. LNCS, vol. 690, pp. 328–342. Springer, Heidelberg (1993) 9. Cirstea, H., Kirchner, C.: The rewriting calculus — Part I and II. Logic Journal of the Interest Group in Pure and Applied Logics 9, 427–498 (2001) 10. Cirstea, H., Kirchner, C., Liquori, L., Wack, B.: Rewrite strategies in the rewriting calculus. In: Gramlich, B., Lucas, S. (eds.) Electronic Notes in Theoretical Computer Science, vol. 86, Elsevier, North-Holland, Amsterdam (2003) 11. Clavel, M., Dur´ an, F., Eker, S., Lincoln, P., Mart´ı-Oliet, N., Meseguer, J., Quesada, J.F.: Maude: speciﬁcation and programming in rewriting logic. Theoretical Computer Science 285(2), 187–243 (2002) 12. Comon, H.: Suﬃcient completeness, term rewriting system and anti-uniﬁcation. In: Siekmann, J.H. (ed.) CADE 1986. LNCS, vol. 230, pp. 128–140. Springer, Heidelberg (1986) 13. Comon, H., Jacquemard, F.: Ground reducibility is EXPTIME-complete. In: Proc. 12th IEEE Symp. Logic in Computer Science, pp. 26–34. IEEE Comp. Soc. Press, Washington, DC, USA (1997) 14. Dershowitz, N., Jouannaud, J.-P.: Handbook of Theoretical Computer Science In: Rewrite Systems, ch. 6, vol. B, pp. 244–320. Elsevier Science Publishers B. V., North-Holland, Amsterdam (Also as: Research report 478, LRI). (1990) 15. Dershowitz, N., Plaisted, D.A.: Rewriting. In: Robinson, A., Voronkov, A. (eds.) Handbook of Automated Reasoning, vol. I, ch.9, pp. 535–610. Elsevier Science Publisher B.V., North-Holland, Amsterdam (2001) 16. Fern´ andez, M.-L., Godoy, G., Rubio, A.: Orderings for innermost termination. In: Giesl, J. (ed.) RTA 2005. LNCS, vol. 3467, pp. 17–31. Springer, Heidelberg (2005)

Narrowing, Abstraction and Constraints for Proving Properties

65

17. Fissore, O., Gnaedig, I., Kirchner, H.: Termination of rewriting with local strategies. In: Bonacina, M.P., Gramlich, B. (eds.) Selected papers of the 4th International Workshop on Strategies in Automated Deduction. Electronic Notes in Theoretical Computer Science, vol. 58, Elsevier Science Publishers B. V., NorthHolland, Amsterdam (2001) 18. Fissore, O., Gnaedig, I., Kirchner, H.: Cariboo: An induction based proof tool for termination with strategies. Proceedings of the 4th International Conference on Principles and Practice of Declarative Programming, Pittsburgh (USA). ACM Press, New York (2002) 19. Fissore, O., Gnaedig, I., Kirchner, H.: Outermost ground termination. In: Proceedings of the 4th International Workshop on Rewriting Logic and Its Applications, Pisa, Italy, September 2002. Electronic Notes in Theoretical Computer Science, vol. 71. Elsevier Science Publishers B. V., North-Holland, Amsterdam (2002) 20. Fissore, O., Gnaedig, I., Kirchner, H.: A proof of weak termination providing the right way to terminate. In: Liu, Z., Araki, K. (eds.) ICTAC 2004. LNCS, vol. 3407, pp. 356–371. Springer, Heidelberg (2004) 21. Fissore, O., Gnaedig, I., Kirchner, H., Moussa, L.: Cariboo, a termination proof tool for rewriting-based programming languages with strategies, Version 1.1. Free GPL Licence, APP registration IDDN.FR.001.170013.001.S.P.2005.000.10600 (December 2005) Available at http://protheo.loria.fr/softwares/cariboo/ 22. Giesl, J., Middeldorp, A.: Transforming Context-Sensitive Rewrite Systems. In: Narendran, P., Rusinowitch, M. (eds.) RTA 1999. LNCS, vol. 1631, pp. 271–285. Springer, Heidelberg (1999) 23. Giesl, J., Middeldorp, A.: Innermost termination of context-sensitive rewriting. In: Ito, M., Toyama, M. (eds.) DLT 2002. LNCS, vol. 2450, pp. 231–244. Springer, Heidelberg (2003) 24. Giesl, J., Thiemann, R., Schneider-Kamp, P., Falke, S.: Improving dependency pairs. In: Vardi, M.Y., Voronkov, A. (eds.) LPAR 2003. LNCS(LNAI), vol. 2850, pp. 165–179. Springer, Heidelberg (2003) 25. Giesl, J., Swiderski, S., Schneider-Kamp, P., Thiemann, R.: Automated Termination Analysis for Haskell: From term rewriting to programming languages. In: Pfenning, F. (ed.) RTA 2006. LNCS, vol. 4098, pp. 297–312. Springer, Heidelberg (2006) 26. Gnaedig, I., Kirchner, H.: Computing constructor forms with non terminating rewrite programs. In: Maher, M. (ed.) Proceedings of the Eighth ACM SIGPLAN Symposium on Principles and Practice of Declarative Programming, Venice, Italy, pp. 121–132. ACM Press, New York (July 2006) 27. Gnaedig, I., Kirchner, H.: Termination of rewriting under strategies: a generic approach, Submitted. Also as HAL-INRIA Open Archive Number inria-00113156 (2006) 28. Gnaedig, I., Kirchner, H., Genet, T.: Induction for Termination. Technical Report 99.R.338, LORIA, Nancy (France) (December 1999) 29. Goguen, J.A., Jouannaud, J.-P., Meseguer, J.: Operational semantics for ordersorted algebra. In: Brauer, W. (ed.) ICALP 1985. LNCS, vol. 194, pp. 221–231. Springer, Heidelberg (1985) 30. Goubault- Larrecq, J.: A proof of weak termination of typed lambda-sigma-calculi. In: Gim´enez, E. (ed.) TYPES 1996. LNCS, vol. 1512, Springer, Heidelberg (1998) 31. Gramlich, B.: Relating innermost, weak, uniform and modular termination of term rewriting systems. In: Voronkov, A. (ed.) LPAR 1992. LNCS(LNAI) vol. 624, pp. 285–296. Springer, Heidelberg (1992)

66

I. Gnaedig and H. Kirchner

32. Gramlich, B.: On proving termination by innermost termination. In: Ganzinger, H. (ed.) Rewriting Techniques and Applications. LNCS, vol. 1103, pp. 93–107. Springer, Heidelberg (1996) 33. Gramlich, B.: On termination and conﬂuence properties of disjoint and constructorsharing conditional rewrite systems. Theoretical Computer Science 165(1), 97–131 (September 1996) 34. Hendrix, J., Clavel, M., Meseguer, J.: A suﬃcient completeness reasoning tool for partial speciﬁcations. In: Giesl, J. (ed.) RTA 2005. LNCS, vol. 3467, pp. 165–174. Springer, Heidelberg (2005) 35. Huet, G., Hullot, J.-M.: Proofs by induction in equational theories with constructors. Journal of Computer and System Sciences, vol. 25(2) , pp. 239–266, 1982 In: Preliminary version Proceedings 21st Symposium on Foundations of Computer Science, October 1982, IEEE (1980) 36. Jouannaud, J.-P., Kounalis, E.: Automatic proofs by induction in theories without constructors. Information and Computation 82, 1–33 (1989) 37. Kapur, D., Narendran, P., Zhang, H.: Proof by induction using test sets. In: Siekmann, J.H. (ed.) CADE 1986, LNCS, vol. 230, pp. 99–117. Springer, Heidelberg (1986) 38. Kapur, D., Narendran, P., Zhang, H.: On suﬃcient completeness and related properties of term rewriting systems. Acta Informatica 24, 395–415 (1987) 39. Kirchner, C., Kirchner, H., Rusinowitch, M.: Deduction with symbolic constraints. Revue d’Intelligence Artiﬁcielle. (Special issue on Automatic Deduction) 4(3), 9–52 (1990) 40. Kirchner, C., Kirchner, H., Vittek, M.: Designing constraint logic programming languages using computational systems. In: Van Hentenryck, P., Saraswat, V. (eds.) Principles and Practice of Constraint Programming. The Newport Papers, ch. 8, pp. 131–158. The MIT press, Cambridge, MA (1995) 41. Kounalis, E.: Completeness in data type speciﬁcations. In: Caviness, B.F. (ed.) ISSAC 1985 and EUROCAL 1985. LNCS, vol. 204, pp. 348–362. Springer, Heidelberg (1985) 42. Kounalis, E.: Testing for the ground (co-)reducibility property in term-rewriting systems. Theoretical Computer Science 106, 87–117 (1992) 43. Kruskal, J.B.: Well-quasi ordering, the tree theorem and Vazsonyi’s conjecture. Trans. Amer. Math. Soc. 95, 210–225 (1960) 44. Lazrek, A., Lescanne, P., Thiel, J.-J.: Tools for proving inductive equalities, relative completeness and ω-completeness. Information and Computation 84(1), 47–70 (1990) 45. Lucas, S.: Termination of context-sensitive rewriting by rewriting. In: Meyer auf der Heide, F., Monien, B. (eds.) ICALP 1996. LNCS, vol. 1099, pp. 122–133. Springer, Heidelberg (1996) 46. Lucas, S.: Termination of on-demand rewriting and termination of OBJ programs. In: Sondergaard, H. (ed.) PPDP’01. Proc. of 3rd International ACM SIGPLAN Conference on Principles and Practice of Declarative Programming, Firenze, Italy, pp. 82–93. ACM Press, New York (September 2001) 47. Lucas, S.: Termination of rewriting with strategy annotations. In: Voronkov, A., Nieuwenhuis, R. (eds.) LPAR 2001. LNCS (LNAI), vol. 2250, pp. 669–684. Springer, Heidelberg (2001) 48. Lucas, S.: Context-sensitive rewriting strategies. Information and Computation 178(1), 294–343 (2002) 49. Mart´ı-Oliet, N., Meseguer, J.: Rewriting logic and its applications: Preface. Theoretical Computer Science 285(2), 119–120 (2002)

Narrowing, Abstraction and Constraints for Proving Properties

67

50. Meseguer, J., Thati, P.: Symbolic reachability analysis using narrowing and its application to the veriﬁcation of cryptographic protocols. In: Marti-Oliet, N., Thati, P., Mart´ı-Oliet, N. (eds.) WRLA 2004. Proceedings of the Fifth International Workshop on Rewriting Logic and Its Applications. Electronic Notes in Theoretical Computer Science, vol. 117, pp. 153–182. (2004) 51. Middeldorp, A., Hamoen, E.: Completeness results for basic narrowing. Applicable Algebra in Engineering, Communication and Computation 5(3 & 4), 213–253 (1994) 52. Moreau, P.-E., Ringeissen, C., Vittek, M.: A pattern matching compiler for multiple target languages. In: Hedin, G. (ed.) CC 2003 and ETAPS 2003. LNCS, vol. 2622, pp. 61–76. Springer, Heidelberg (2003) 53. Nguyen, Q-H.: Compact normalisation trace via lazy rewriting. In: Lucas, S., Gramlich, B. (eds.) WRS 2001. Proc. 1st International Workshop on Reduction Strategies in Rewriting and Programming, vol. 57, Elsevier Science Publishers B. V., North-Holland, Amsterdam (2001) 54. Nipkow, T., Weikum, G.: A decidability result about suﬃcient completeness of axiomatically speciﬁed abstract data types. In: Cremers, A.B., Kriegel, H.-P. (eds.) Theoretical Computer Science. LNCS, vol. 145, pp. 257–268. Springer, Heidelberg (1983) 55. Panitz, S.E., Schmidt-Schauss, M.: TEA: Automatically proving termination of programs in a non-strict higher-order functional language. In: Van Hentenryck, P. (ed.) SAS 1997. LNCS, vol. 1302, pp. 345–360. Springer, Heidelberg (1997) 56. Plaisted, D.: Semantic conﬂuence tests and completion methods. Information and Control 65, 182–215 (1985) 57. Visser, E.: Stratego: A language for program transformation based on rewriting strategies. System description of Stratego 0.5 (LP:0). In: Middeldorp, A. (ed.) Rewriting Techniques and Applications 2001. LNCS, vol. 2051, pp. 357–361. Springer, Heidelberg (2001)

Computability Closure: Ten Years Later Frédéric Blanqui INRIA LORIA, Campus Scientiﬁque, BP 239 54506 Vandoeuvre-lès-Nancy Cedex, France

Abstract. The notion of computability closure has been introduced for proving the termination of higher-order rewriting with ﬁrst-order matching by Jean-Pierre Jouannaud and Mitsuhiro Okada in a 1997 draft which later served as a basis for the author’s PhD. In this paper, we show how this notion can also be used for dealing with β-normalized rewriting with matching modulo βη (on patterns à la Miller), rewriting with matching modulo some equational theory, and higher-order data types (types with constructors having functional recursive arguments). Finally, we show how the computability closure can easily be turned into a reduction ordering which, in the higher-order case, contains Jean-Pierre Jouannaud and Albert Rubio’s higher-order recursive path ordering and, in the ﬁrstorder case, is equal to the usual ﬁrst-order recursive path ordering.

1

Introduction

After Jan Willem Klop’s PhD thesis on Combinatory Reduction Systems (CRS) [28,29], the interest in higher-order rewriting, or the combination of λ-calculus and rewriting, was relaunched by Dale Miller and Gopalan Nadathur’s work on λ-Prolog [38] and Val Breazu-Tannen’s paper on the modularity of conﬂuence for the combination of simply-typed λ-calculus and ﬁrst-order rewriting [10,13]. A year later, Dale Miller proved the decidability of uniﬁcation modulo βη for “higher-order patterns” [36,37], and the modularity of termination for simplytyped λ-calculus and ﬁrst-order rewriting was independently proved by Jean Gallier and Val Breazu-Tannen [11,12] and Mitsuhiro Okada [40], both using Jean-Yves Girard’s technique of reducibility predicates [18,19,20]. A little bit later, Daniel Dougherty showed, by purely syntactic means (without using reducibility predicates), that these results could be extended to any “stable” set of untyped λ-terms [16,17], the set of simply-typed λ-terms being stable. We must also mention Zhurab Khasidashvili’s new approach to higher-order rewriting with his Expression Reduction Systems (ERS) [27]. Then, in 1991, two important papers were published on this subject, both introducing a new approach to higher-order rewriting: Tobias Nipkow’s Higherorder Rewrite Systems (HRS) [39,33], and Jean-Pierre Jouannaud and Mitsuhiro Okada’s Executable Higher-Order Algebraic Speciﬁcation Languages [22,23].

UMR 7503 CNRS-INPL-INRIA-Nancy2-UHP.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 68–88, 2007. c Springer-Verlag Berlin Heidelberg 2007

Computability Closure: Ten Years Later

69

Tobias Nipkow’s approach is based on Dale Miller’s result: the simply-typed λ-calculus, which is conﬂuent and terminating, is used as a framework for encoding higher-order rewriting. He extends to this framework the Critical Pair Lemma. Jean-Pierre Jouannaud and Mitsuhiro Okada’s approach can be seen as a typed version of CRS’s (restricted to ﬁrst-order matching). They proved that termination is modular for the combination of simply-typed λ-calculus, a nonduplicating1 terminating ﬁrst-order rewrite system, and an higher-order rewrite system which deﬁnition follows a “general schema” extending primitive recursion. Later, Vincent van Oostrom and Femke van Raamsdonk compared CRS’s and HRS’s [46] and developed an axiomatized framework subsuming them [47,49]. The combination of β-reduction and rewriting is naturally used in dependent type systems and proof assistants implementing the proposition-as-type and proof-as-object paradigm [6]. In these systems, two propositions equivalent modulo β-reduction and rewriting are considered as equivalent (e.g. P (2+2) and P (4)). This is essential for enabling users to formalize large proofs with many computations, as recently shown by Georges Gonthier and Benjamin Werner’s proof of the Four Color Theorem in the Coq proof assistant. However, checking the correctness of user proofs requires to check the equivalence of two terms. Hence, the necessity to have termination criteria for the combination of βreduction and a set R of higher-order rewrite rules. For proving the correctness of the general schema, Jean-Pierre Jouannaud and Mitsuhiro Okada used Jean-Yves Girard’s technique of reducibility predicates. Roughly speaking, since proving the (strong) β-normalization by induction on the structure of terms does not work directly, one needs to prove a stronger predicate. In 1967, William Tait introduced a “convertibility predicate” for proving the weak normalization of some extension of Kurt Gödel’s system T [43]. Later, in 1971, Jean-Yves Girard introduced “reducibility predicates” (called computability predicates in the following) for proving the weak and strong normalization of the polymorphic λ-calculus [18,19]. This technique can be applied to (higher-order) rewriting by proving that every function symbol is computable, that is, that every function call is computable whenever its arguments so are. This naturally leads to the following question: which operations preserve computability? Indeed, from a set of such operations, one can deﬁne the computability closure of a term t, written CC(t), as the set of terms that are computable whenever t so is. Then, to get normalization, it suﬃces to check that, for every rule f l → r ∈ R, r belongs to the computability closure of l. Examples of computability-preserving operations are: application, function calls on arguments smaller than l in some well-founded ordering >, etc. Jean-Pierre Jouannaud and Mitsuhiro Okada introduced this notion in a 1997 draft which served as a basis for [8,9]. In this paper, we show how this notion can be extended for dealing with β-normalized rewriting with matching modulo βη on patterns à la Miller and matching modulo some equational theory. Another way to prove the termination of R is to ﬁnd a decidable well-founded rewrite relation containing R. A well known such relation in the ﬁrst-order case 1

l → r is non-duplicating if no variable has more occurrences in r than it has in l.

70

F. Blanqui

is the recursive path ordering [41,14] which well-foundedness was initially based on Kruskal theorem [30]. The ﬁrst attempts made for generalizing this ordering to the higher-order case were not able to orient system T [31,32,26]. Finally, in 1999, Jean-Pierre Jouannaud and Albert Rubio succeeded in ﬁnding such an ordering [25] by using computability-based techniques again, hence providing the ﬁrst well-foundedness proof of RPO not based on Kruskal theorem. This ordering was later extended to the calculus of constructions by Daria Walukiewicz [50,51]. Although the computability closure on one hand, and the recursive path ordering on the other hand, share the same computability-based techniques, there has been no precise comparison between these two termination criteria. In [51], one can ﬁnd examples of rules that are accepted by one criterion but not the other. And Jean-Pierre Jouannaud and Albert Rubio themselves use the notion of computability closure for strengthening HORPO. In this paper, we explore the relations between both criteria. We start from the trivial remark that the computability closure itself provides us with an ordering: let t CR(>) u if t = f t and u ∈ CC> (t), where CC> is the computability closure built by using a well-founded relation > for comparing the arguments between function calls. Proving the well-foundedness of this ordering simply consists in proving that the computability closure is correct, which can be done by induction on >. Then, we remark that the function mapping > to CR(>) is monotone wrt inclusion. Thus, it admits a least ﬁxpoint which is a well-founded ordering. We prove that this ﬁxpoint contains HORPO and is equal to RPO in the ﬁrst-order case.

2

Terms and Types

We consider simply-typed λ-terms with curried constants. See [2] for details about typed λ-calculus. For rewriting, we follow the notations of Nachum Dershowitz and Jean-Pierre Jouannaud’s survey [15]. Let B be a set of base types. The set T of simple types is inductively deﬁned as usual: T ∈ T = B ∈ B | T ⇒ T . Let X be a set of variables and F be a set of function symbols disjoint from X . We assume that every a ∈ X ∪ F is equipped with a type τa ∈ T. The sets T T of terms of type T are inductively deﬁned as follows: – If a ∈ X ∪ F, then a ∈ T τa . – If x ∈ X and t ∈ T U , then λxt ∈ T τx ⇒U . – If v ∈ T T ⇒U and t ∈ T T , then vt ∈ T U . As usual, we assume that, for all type T , the set of variables of type T is inﬁnite and consider terms up to α-conversion (type-preserving renaming of bound variables). Let FV(t) be the set of variables free in t. Let t denote a sequence of terms t1 , . . . , tn of length n = |t| ≥ 0. Let τ (t) denote the type of a term t. In the following, writing t : T or tT means that τ (t) = T .

Computability Closure: Ten Years Later

71

The set Pos(t) of positions in a term t is deﬁned as usual as words on {1, 2}. Let t|p be the subterm of t at position p ∈ Pos(t), and t[u]p be the term obtained by replacing in t its subterm at position p ∈ Pos(t) by u. A term is algebraic if it contains no abstraction and no subterm of the form xt. A term t is linear if no variable free in t occurs more than once in t. The β-reduction is the closure by context of the relation (λxt)u →β tux where u tx denotes the higher-order substitution of x by u in t. A rewrite rule is a pair of terms l → r such that l is of the form f l, FV(r) ⊆ FV(l) and τ (l) = τ (r). Given a set R of rewrite rules, let →R be the closure by context and substitution of R. Hence, matching is modulo α-conversion (but α-conversion is needed only for left-hand sides having abstractions). A rule l → r is linear (resp. algebraic) if both l and r are linear (resp. algebraic). Given a relation → on terms, let ←, →= and →∗ be its inverse, its reﬂexive closure and its reﬂexive and transitive closure respectively. Let also → (t) = {t ∈ T | t → t } be the set of reducts of t, and SN(→) (resp. SNT (→)) be the set of terms (resp. of type T ) that are strongly normalizable wrt →. Our aim is to prove the termination (strong normalization, well-foundedness) of → = →β ∪ →R . Given a relation >, let >lex , >mul and >prod respectively denote the lexicographic, multiset and product extensions of >. Note that all these extensions are well-founded whenever > is well-founded.

3

Computability

In this section, we remind the notion of computability predicate introduced by William Tait [43,44] and extended by Jean-Yves Girard with the notion of neutral2 term [19,20]. Every type is interpreted by a set of computable terms of that type. Since computability is deﬁned so as to imply strong normalization, the latter is obtained by proving that every term is computable. In the following, we assume given a set R of rewrite rules. Definition 1 (Reducibility candidates). A term is neutral if it is of the form xv or of the form (λxt)uv. Let → = →β ∪ →R . A reducibility candidate for the type T is a set P of terms such that: (1) P ⊆ SNT (→). (2) P is stable by →: →(P ) ⊆ P . (3) If t : T is neutral and →(t) ⊆ P , then t ∈ P . Let QTR be the set of all reducibility candidates for the type T , and IR be the set of functions I from B to 2T such that, for all B ∈ B, I(B) ∈ QBR . Given an interpretation of base types I ∈ IR , we define an interpretation [[T ]]IR ∈ QTR for every type T as follows: – [[B]]IR = I(B), – [[T ⇒ U ]]IR = {v ∈ SNT ⇒U | ∀t ∈ [[T ]]IR , vt ∈ [[U ]]IR }. 2

simple in [19].

72

F. Blanqui

One can check that SNT is a reducibility candidate for T . We now check that the interpretation of a type is a reducibility candidate. Lemma 1. If I ∈ IR then, for all type T , [[T ]]IR ∈ QTR . Proof. We proceed by induction on T . The lemma is immediate for T ∈ B. I Assume now that [[T ]]IR ∈ QTR and [[U ]]IR ∈ QU R . We prove that [[T ⇒ U ]]R ∈ T ⇒U QR . (1) [[T ⇒ U ]]IR ⊆ SNT ⇒U by deﬁnition. (2) Let v ∈ [[T ⇒ U ]]IR , v ∈ →(v) and t ∈ [[T ]]IR . We must prove that v t ∈ [[U ]]IR . I This follows from the facts that [[U ]]IR ∈ QU R , vt ∈ [[U ]]R and v t ∈ →(vt). T ⇒U I (3) Let v be a neutral term such that →(v) ⊆ [[T ⇒ U ]]R and t ∈ [[T ]]IR . We must prove that vt ∈ [[U ]]IR . Since v is neutral, vt is neutral too. Since I I T [[U ]]IR ∈ QU R , it suﬃces to prove that →(vt) ⊆ [[U ]]R . Since [[T ]]R ∈ QR , t ∈ SN and we can proceed by induction on t with → as well-founded ordering. Let w ∈ →(vt). Since v is neutral, either w = v t with v ∈ →(v), or w = vt with t ∈ →(t). In the former case, w ∈ [[U ]]IR since v ∈ [[T ⇒ U ]]IR .

In the latter case, we conclude by induction hypothesis on t . Finally, we come to the deﬁnition of computability. Definition 2 (Computability). Let I be the base type interpretation such that I(B) = SNB . A term t : T is computable if t ∈ [[T ]]IR . In the following, we drop the superscript I in [[T ]]IR . We do not know how to prove that computability is stable by subterm before proving that every term is computable. However, since, on base types, computability is equivalent to strong normalization, the subterms of base type of a computable term are computable. This is in particular the case for the arguments of base type of a function symbol: Definition 3 (Accessibility). For all f : T ⇒ B, let Acc(f ) = {i | Ti ∈ B} be the set of accessible arguments of f . We now prove some properties of computable terms. Lemma 2 (Computability properties). (C1) If t, u and tux are computable, then (λxt)u is computable. (C2) If every symbol is computable, then every term is computable. (C3) If f t is computable and i ∈ Acc(f ), then ti is computable. (C4) A term f t : B is computable whenever t are computable and every headreduct of f t is computable. (C5) A symbol f : T ⇒ B is computable if every head-reduct of f t is computable whenever t : T are computable. (C6) A symbol f is computable if, for every rule f l → r ∈ R and substitution σ, rσ is computable whenever lσ are computable.

Computability Closure: Ten Years Later

73

Proof. (C1) Since (λxt)u is neutral, it suﬃces to prove that every reduct is computable. We proceed by induction on (t, u) with →prod as well-founded ordering (t and u are computable). Assume that (λxt)u → v. If v = tux , then t is computable by assumption. Otherwise, v = (λxt )u with t → t , or v = (λxt)u with u → u . In both cases, we can conclude by induction hypothesis. (C2) First note that the identity substitution is computable since variables are computable (they are neutral and irreducible). We then prove that, for every term t and computable substitution θ, tθ is computable, by induction on t. – Assume that t = f ∈ F. Then, tθ = f is computable by assumption. – Assume that t = x ∈ X . Then, tθ = xθ is computable by assumption. – Assume that t = λxu. Then, tθ = λxuθ. Let v : V computable. We must prove that tθv is computable. By induction hypothesis, uθxv is computable. Since uθ and v are computable too, by (C1), tθ is computable. – Assume that t = uV ⇒T v. Then, tθ = uθvθ. By induction hypothesis, uθ and vθ are computable. Thus, tθ is computable. (C3) By deﬁnition of the interpretation of base types. (C4) By deﬁnition of the interpretation of base types, it suﬃces to prove that every reduct of f t is computable. We prove it by induction on t with →prod as well-founded ordering (t are computable). Head-reducts are computable by assumption. For non-head-reducts, this follows by induction hypothesis. (C5) By deﬁnition of the interpretation of arrow types and (C4). (C6) After (C5), it suﬃces to prove that every head-reduct of f t is computable whenever t are computable. Let t be a head-reduct of f t. Then, there is l → r ∈ R and σ such that t = lσ and t = rσ. Thus, t is computable.

4

Computability Closure

After the properties (C2) and (C6), we are left to prove that, for every rule f l → r ∈ R, rσ is computable whenever lσ are computable. This naturally leads us to ﬁnd a set CCf (l) of terms t such that tσ is computable whenever lσ are computable: the computability closure of l wrt f . We can include l and close this set with computability-preserving operations like applying a term to another or taking the accessible argument of a function call. We can also include variables distinct from FV(l) and allow abstraction on them by strengthening the property to prove as follows: for all t ∈ CCf (l), tσ is computable whenever lσ are computable and σ is computable on FV(t) \ FV(l). Now, to allow function calls, the idea is to introduce a precedence on function symbols and a well-founded ordering > on function arguments. So, we assume given a quasi-ordering ≥F on F which strict part >F = ≥F \ ≤F is well-founded. Let F = ≥F ∩ ≤F be its associated equivalence relation.

74

F. Blanqui

We also assume that every symbol f is equipped with a status statf ∈ {lex, mul}, such that statf = statg whenever f F g, deﬁning how the arguments of f must be compared: lexicographically (from left to right, or from right to left) or by multiset. Definition 4 (Status relation). The status relation associated to a relation > is the relation (f, t) >stat (g, u) such that f >F g or f F g and t >statf u. Note that the status relation >stat is well-founded whenever > so is. We now formalize the notion of computability closure. Definition 5. A function CC mapping every f T ⇒B and lT to a set of terms CCf (l) is a computability closure if, for all f T ⇒B , lT , r ∈ CCf (l) and θ, rθ is computable whenever lθ are computable and θ is computable on X \ FV(l). We now check that the computability of symbols, hence the termination of →β ∪ →R by (C2), can be obtained by using a computability closure. Lemma 3. If CC is a computability closure and, for all rule f l → r ∈ R, r ∈ CCf (l), then every symbol is computable. Proof. It follows from (C6) and the fact that FV(r) ⊆ FV(l).

We now present a computability closure similar to the one introduced in [8,9] except that the relation > used for comparing arguments in recursive calls is

(arg)

gu ∈ CCf> (l)

(decomp-symb)

f F g U ⇒U

f >F g g ∈ CCf> (l) uU ∈ CCf> (l) gu ∈

V ⇒T

(app)

u

uv ∈

l l >fstat u f

CCf> (l)

∈ CCf> (l)

(var)

(lam)

i ∈ Acc(g)

ui ∈ CCf> (l)

(prec)

(call)

li ∈ CCf> (l)

v V ∈ CCf> (l)

CCf> (l)

x∈ / FV(l) x ∈ CCf> (l)

u ∈ CCf> (l)

x∈ / FV(l)

λxu ∈ CCf> (l)

Fig. 1. Higher-order computability closure

Computability Closure: Ten Years Later

75

replaced by an abstract family of relations (>l )l∈T . We then prove the correctness of this abstract computability closure under some condition. Definition 6 (Closure-compatibility). A relation is closure-compatible with a family of relations (>l )l∈T if, for all l and θ, tθ uθ whenever t >l u, tθ and uθ are computable, and θ is computable on X \ FV(l). Note that any relation stable by substitution > is closure-compatible with itself (the constant family equal to >). This is in particular the case of the restriction of the subterm ordering > deﬁned by t > u if u is a subterm of t and FV(u) ⊆ FV(t). Lemma 4. Let > = (>l )l∈T be a family of relations. The function CC> defined in Figure 1 is a computability closure whenever there exists a well-founded relation on computable terms that is closure-compatible with >. Proof. We proceed by induction, ﬁrst on (f, lθ) with stat as well-founded ordering (H1), and second, by induction on CCf> (l) (H2). (arg) li θ is computable by assumption. (decomp-symb) By (H2), guθ is computable. Thus, after (C3), ui θ is computable. (prec) By (H1), g is computable. l (call) By (H2), uθ are computable. Since l >fstat u, is closure-compatible f with >, lθ and uθ are computable, and θ is computable on X \ FV(l), we have lθ statf uθ. Therefore, by (H1), guθ is computable. (app) By (H2), uθ and vθ are computable. Thus, uθvθ is computable. (var) Since x ∈ X \ FV(l), xθ is computable by assumption. (lam) Wlog we can assume that x ∈ / codom(θ). Thus, (λxu)θ = λxuθ. Let v : τx computable. After (C1), (λxuθ)v is computable if uθ, v and uθxv are computable. We have v computable by assumption and uθ and uθxv computable by (H2).

5

β-Normalized Rewriting with Matching Modulo βη

In this section, we show how the notion of computability closure can be extended to deal with HRS’s [39]. This extends our previous results on CRS’s and HRS’s [5]. This computability closure approach seems simpler than the technique of “neutralization” introduced by Jean-Pierre Jouannaud and Albert Rubio in [24]. However, the comparison between both approaches remains to be done. In HRS’s, rewrite rules are of base type, rule left-hand sides are patterns à la Miller [37], and rewriting is deﬁned on terms in β-normal η-long form as follows: t ⇒R u if there are p ∈ Pos(t), l → r ∈ R and σ in β-normal η-long form such that t|p = lσ ↓β ↑η and u = t[rσ ↓β ↑η ]p . We are going to consider a slightly more general notion of rewriting: βnormalized rewriting with matching modulo βη, deﬁned as follows: t →R,βη u if there are p ∈ Pos(t), l → r ∈ R and σ in β-normal form such that t|p is in

76

F. Blanqui

β-normal form, t|p =βη lσ and u = t[rσ]p . Furthermore, we do not assume that rules are of base type. However, in this case, one can check that, on terms in β-normal η-long form, ⇒R ⊆ →R,βη →∗β . Matching modulo βη is necessary when a rule left-hand side contains abstractions. Consider for instance the left-hand side l = Dλx(sin(F x)). With matching modulo α-conversion only, the term t = Dλx(sin u) matches p only if u is of the form vx. In particular, Dλx(sin x) does not match p. Yet, if one substitutes F by λxu in l, then one gets D(λx(sin((λxu)x))) which β-reduces to t. Take now l = Dλx(F x). With matching modulo α-conversion only, the term t = Du matches l only if u is of the form λxv. In particular, (D sin) does not match l. Yet, if one substitutes F by u in l, then one gets Dλx(ux) which ηreduces to t since x ∈ / FV(u) (by deﬁnition of higher-order substitution). Higher-order patterns are terms in β-normal η-long form which free variables are applied to terms η-equivalent to distinct bound variables. Hence, if l is a pattern, t and σ are in β-normal form and lσ =βη t, then lσ →∗β0 =η t, where →β0 is the restriction of →β to redexes of the form (λxt)x, that is, (λxt)x →β0 t [37]. Now, for proving the termination of →β ∪ →R,βη (hence the termination of the HRS rewrite relation ⇒R ), it suﬃces to adapt the notion of computability by replacing →R by →R,βη . One can check that all the proofs of the computability properties are still valid except the one for (C6) for which we give a new proof: Lemma 5 (C6). A symbol f is computable if, for every rule f l → r ∈ R and substitution σ, rσ is computable whenever lσ are computable. Proof. After (C5), for proving that f : T ⇒ B is computable, it suﬃces to prove that every head-reduct of f t is computable whenever t : T are computable. Let t be a head-reduct of f t. Then, f t is in β-normal form and there are f l → r ∈ R and σ such that f lσ ←∗β0 =η f t and t = rσ. To conclude, it suﬃces to check that lσ are computable. To this end, we prove that computability is preserved by η-reduction, ηexpansion and β0 -expansion. Let t be a computable term and let u be a term obtained from t by η-reduction, η-expansion or β0 -expansion. We prove that u is computable when u is of base type. If u is not of base type then, by applying it to computable terms of appropriate types, we get a term of base type. On base types, computability is equivalent to strong normalization. Thus, it suﬃces to prove that every reduct of u is strongly normalizable. In each case, we proceed by induction on t with → as well-founded ordering (t is computable). – β0 -expansion: t ←β0 u. If u →β u then either u = t is computable or, by conﬂuence of β and since β0 makes no duplication, there is t such that t →β t ←∗β0 u . Now, if u →R u then, since R-redexes are in β-normal form, the β0 -redex is either above the R-redex or at a disjoint position. Thus, there is u such that t →R t ←β0 u . In both cases, we can conclude by induction hypothesis. – η-reduction: t →η u. If u →β u then, by postponement of η wrt β (→η →β ⊆ + ∗ ∗ →+ β →η ), there is t such that t →β t →η u . Now, if u →R u then, since

Computability Closure: Ten Years Later

77

R-redexes are in β-normal form, either the η-redex is a β-redex and t →β u →R t = u , or there is t such that t →R t →∗η u . In both cases, we can conclude by induction hypothesis. – η-expansion: t ←η u. If u →β u then either u = t is computable or, by conﬂuence of βη, there is t such that t →β t ←∗η u . Now, if u →R u then, since R-redexes are in β-normal form, there is t such that t →R t ←∗η u . In both cases, we can conclude by induction hypothesis.

By property (C2) and Lemma 4, it follows that → = →β ∪ →R,βη is well-founded if, for all rule f l → r ∈ R, r ∈ CCf> (l).

(decomp-lam)

(decomp-app-left)

λyu ∈ CCf> (l) u∈ uy ∈

CCf> (l)

y∈ / FV(l)

CCf> (l) y∈ / FV(l) ∪ FV(u)

u ∈ CCf> (l)

Fig. 2. Decomposition rules for higher-order patterns

Now, for dealing with patterns à la Miller, we also need to add new decomposition rules in the computability closure. Lemma 6. The function CC> defined by the rules of Figure 1 and 2 is a computability closure whenever there exists a well-founded relation on computable terms that is closure-compatible with >. Proof. We extend the proof of Lemma 4 with the new decomposition rules. (decomp-lam) Let θ be the restriction of θ to dom(θ)\{y}. Wlog, we can assume that y ∈ / codom(θ). Hence, (λyu)θ = λyuθ . Now, since dom(θ) ⊆ FV(u) \ FV(l), dom(θ ) ⊆ FV(λyu) \ FV(l). Thus, by (H2), λyuθ is computable. Since yθ is computable, (λyuθ )yθ is computable. Thus, by β-reduction, uθyθ y is computable too. Finally, since y ∈ / dom(θ ) ∪ codom(θ ), uθyθ y = uθ. (decomp-app-left) Let v : τy computable. Since dom(θ) ⊆ FV(u)\FV(l) and y ∈ / FV(l), dom(θyv ) = dom(θ) ∪ {y} ⊆ FV(uy) \ FV(l). Thus, by (H2), (uy)θyv = uθyv v is computable. Since y ∈ / FV(u), uθyv = uθ. Thus, uθ is computable.

6

Matching Modulo Some Equational Theory

In this section, we show how the notion of computability closure can be used for proving the termination of the combination of β-reduction and rewriting with matching modulo some equational theory E [48,21].

78

F. Blanqui

To this end, we assume that E is a symmetric set of rules, that is, l → r ∈ E iﬀ r → l in E. By deﬁnition of rewrite rules (see Section 2), this implies that, for all l → r ∈ E, r is of the form gr and FV(l) = FV(r). This includes associativity and commutativity but excludes collapsing rules like x + 0 → x and erasing rules like x × 0 → 0. Then, rewriting with matching modulo can be deﬁned as follow: t →R,E u if there are p ∈ Pos(t), l → r ∈ R and σ such that t|p →∗E lσ and u = t[rσ]p . Rewriting with matching modulo E is diﬀerent from rewriting modulo E which is →∗E →R . The point is that, with matching modulo E, no E-step takes place above t|p when one rewrites a term t at some position p ∈ Pos(t). Hence, we correct an error in [4] (Theorem 6) where it is claimed that →β ∪ →∗E →R is terminating. What is in fact proved in [4] is the termination of →β ∪ →∗E1 →R1 ∪→Rω ,Eω where E1 and R1 (resp. Eω and Rω ) are the ﬁrst-order (resp. higher-order) parts of E and R respectively. For proving the termination of →β ∪ →R,E , it suﬃces to adapt computability by replacing →R by →R,E . One can check that all the proofs of computability properties are still valid except the one for (C6) for which we give a new proof: Lemma 7 (C6). Let E be a symmetric set of rules. Assume that is a wellfounded relation on computable terms closure-compatible with > and that, for all rule f l → gr ∈ E, r ∈ CCf> (l). Then, f is computable if, for every rule f l → r ∈ R and substitution σ, rσ is computable whenever lσ are computable. Proof. By Lemma 4, CC> is a computability closure. After (C5), for proving that f : T ⇒ B is computable, it suﬃces to prove that every head-reduct of f t is computable whenever t : T are computable. Let t be a head-reduct of f t. Then, there is gl → r ∈ R and σ such that f t →∗E glσ and t = rσ. By deﬁnition of computability closure, lσ are computable since t are computable (induction on the number of E-steps). Therefore, rσ is computable.

By property (C2) and Lemma 4, it follows that → = →β ∪ →R,E is wellfounded if moreover, for all rule f l → r ∈ R, r ∈ CCf> (l).

7

Higher-Order Data Types

Until now, we used the subterm ordering in (call). But this ordering is not strong enough to handle recursive deﬁnitions on higher-order data types, i.e. data types with constructors having functional recursive arguments. Consider for instance a type P representing processes with a sequence operator ; : P ⇒ P ⇒ P and a data-dependent choice operator Σ : (D ⇒ P) ⇒ P. Then, in the following simpliﬁcation rule [45]: (ΣP ); x → Σλy(P y; x) the term P y is not a subterm of ΣP .

Computability Closure: Ten Years Later

79

In this section, we describe an extension of the computability closure to handle such deﬁnitions. It is based on the interpretation of “positive” higher-order data types introduced by Nax Paul Mendler in 1987 [34,35]. As usual, the set Pos(T ) of positions in a type T is deﬁned as words on {1, 2}. The sets Pos+ (T ) and Pos− (T ) of positive and negative positions respectively are inductively deﬁned as follows: – Posδ (B) = {ε}. – Posδ (T ⇒ U ) = 1 · Pos−δ (T ) ∪ 2 · Posδ (U ). Let Pos(B, T ) be the positions of the occurrences of B in T . A base type B occurs only positively (resp. negatively) in a type T if Pos(B, T ) ⊆ Pos+ (T ) (resp. Pos(B, T ) ⊆ Pos− (T )). Nax Paul Mendler showed that the combination of β-reduction and reduction rules for a “case” or “match” construction does not terminate if a data type B has a constructor having an argument in the type of which B occurs negatively (we say that B is not positive). Take for instance c : (B ⇒ N) ⇒ B, f : B ⇒ (B ⇒ N) together with the rule f (cx) →R x. Then, by taking ω = λxf xx : B ⇒ N, we have ω(cω) →β f (cω)(cω) →R ω(cω) →β . . . He also showed that the set of all reducibility candidates is a complete lattice for inclusion and that, if B is positive, then one can build an interpretation of B as the ﬁxpoint of a monotone functional on reducibility candidates, in which the reduction rules for the case construction are safe. In this case, we can say that every argument of a constructor is accessible. We extend this notion of accessibility to every (deﬁned or undeﬁned) function symbol as follows. Definition 7 (Accessible arguments). For every f T ⇒B ∈ F, let Acc(f ) = {i ≤ |T | | Pos(B, Ti ) ⊆ Pos+ (Ti )}. In our example, we have Pos(P, D ⇒ P) = {2} = Pos+ (D ⇒ P) and Pos(P, P) = {ε} = Pos+ (P). Thus, Acc(Σ) = {1} and Acc(; ) = {1, 2}. We now deﬁne the functional the least ﬁxpoint of which will provide the interpretation of base types. Lemma 8. The function FRI (B) = {t ∈ SNB | ∀f T ⇒B t, t →∗ f t ⇒ ∀i ∈ Acc(f ), ti ∈ [[Ti ]]IR } is a monotone function on IR . Proof. We ﬁrst prove that P = FRI (B) ∈ QBR . (1) P ⊆ SNB by deﬁnition. (2) Let t ∈ P , t ∈ →(t), f : T ⇒ B and t such that t →∗ f t. We must prove that t ∈ [[T ]]R . It follows from the facts that t ∈ P and t →∗ f t. (3) Let tB neutral such that →(t) ⊆ P . Let f T ⇒B , t such that t →∗ f t and i ∈ Acc(f ). We must prove that ti ∈ [[Ti ]]R . Since t is neutral, t = f t. Thus, there is t ∈ →(t) such that t →∗ f t. Since t ∈ P , ti ∈ [[Ti ]]R . For the monotony, let ≤+ = ≤ and ≤− = ≥. Let I ≤ J iﬀ, for all B, I(B) ⊆ J(B). We ﬁrst prove that [[T ]]IR ⊆δ [[T ]]JR whenever I ≤ J and Pos(B, T ) ⊆ Posδ (T ), by induction on T .

80

F. Blanqui

– Assume that T = C ∈ B. Then, δ = +, [[T ]]IR = I(C) and [[T ]]IR = J(C). Since I(C) ⊆ J(C), [[T ]]IR ⊆ [[T ]]IR . – Assume that T = U ⇒ V . Then, Pos(B, U ) ⊆ Pos−δ (U ) and Pos(B, V ) ⊆ Posδ (V ). Thus, by induction hypothesis, [[U ]]IR ⊆−δ [[U ]]JR and [[V ]]IR ⊆δ [[V ]]JR . Assume that δ = +. Let t ∈ [[T ]]IR and u ∈ [[U ]]JR . We must prove that tu ∈ [[V ]]JR . Since [[U ]]IR ⊇ [[U ]]JR , tu ∈ [[V ]]IR . Since [[V ]]IR ⊆ [[V ]]JR , tu ∈ [[V ]]JR . It works similarly for δ = −. Assume now that I ≤ J. We must prove that, for all B, FRI (B) ⊆ FRJ (B). Let B ∈ B and t ∈ FRI (B). We must prove that t ∈ FRJ (B). First, we have t ∈ SNB since t ∈ FRI (B). Assume now that t →∗ f T ⇒B t and let i ∈ Acc(f ). We must prove that ti ∈ [[Ti ]]JR . Since t ∈ FRI (B), ti ∈ [[Ti ]]IR . Since i ∈ Acc(f ),

Pos(B, Ti ) ⊆ Pos+ (Ti ) and [[Ti ]]IR ⊆ [[Ti ]]JR . Definition 8 (Computability). Let IR be the least fixpoint of FR . A term t : T is computable if t ∈ [[T ]]IRR . In the following, we drop the superscript IR in [[T ]]IRR . One can check that all the proofs of computability properties are still valid except the one for (C4) for which we give a new proof: Lemma 9 (C4). A term f t : B is computable whenever t are computable and every head-reduct of f t is computable. Proof. We ﬁrst need to prove that f t is SN. This follows from the previous proof of (C4). Assume now that f t →∗ gu and i ∈ Acc(g). We prove that ui is computable by induction on t with →prod as well-founded ordering (t are computable). If f t = gu, then ui = ti is computable by assumption. Otherwise, f t → v →∗ gu. If v is a head-reduct of f t, then v and ui are computable. Otherwise, we conclude by induction hypothesis.

The least ﬁxpoint of FR is reachable by transﬁnite iteration from the smallest element of IR . This provides us with an ordering that can handle deﬁnitions on higher-order data types. Definition 9 (Size ordering). For all B ∈ B and t ∈ [[B]]R , let the size of t be the smallest ordinal oBR (t) = a such that t ∈ FRa (∅)(B), where FRa is the transfinite a-iteration of FR . Let R be the union of all the relations TR inductively defined on [[T ]]R as follows: – t BR u if oBR (t) ≥ oBR (u). – t TR⇒U u if, for all v ∈ [[T ]]R , tv U R uv. In our example, we have [[P]]R = {t ∈ SNP | ∀f T ⇒P t, t →∗ f t ⇒ ∀i ∈ Acc(f ), ti ∈ [[Ti ]]R }. Since Acc(Σ) = {1}, if ΣP ∈ [[P]]R then, for all d ∈ [[D]]R , P d ∈ [[P]]R and oPR (P d) < oPR (ΣP ). We immediately check that the size ordering is well-founded.

Computability Closure: Ten Years Later

81

Lemma 10. R is a well-founded quasi-ordering containing →. Proof. The relation R is the union of pairwise disjoint relations. Hence, it suﬃces to prove that each one is transitive and well-founded. We proceed by induction on T . For T ∈ B, this is immediate. Assume now that (ti )i∈N is an increasing sequence for TR⇒U . Since variables are computable, let x ∈ [[T ]]R . By deﬁnition of TR⇒U , (ti x)i∈N is an increasing sequence for U

R.

(>base)

(>lam)

i ∈ Acc(g) g A⇒B aA

a >l bx

(>red) (>trans)

b ∈ X \ FV(l) ⇒B B >l aB b i

x ∈ X \ (FV(b) ∪ FV(l)) λxa > b a > l b b →β c a >l c a >l b b >l c a >l c

Fig. 3. Accessibility ordering

We now deﬁne some relation strong enough for capturing deﬁnitions on higherorder data types and with which R is closure-compatible. Lemma 11. R is closure-compatible with the family (>l )l∈T defined Figure 3. Proof. We prove that aθ R bθ whenever a >l b, aθ and bθ are computable, and θ is computable on X \ FV(l). Ia

(>base) By deﬁnition of IR , oR (gaθ) = a + 1 and ai θ ∈ [[B ⇒ B]]RR . Since b ∈ X \FV(l) and θ is computable on X \FV(l), bθ are computable. Therefore, a (B) and aR (gaθ) > a ≥ oR (ai θbθ). ai θbθ ∈ IR (>lam) Let w : τx computable. Wlog we can assume that x ∈ / dom(θ) ∪ codom(θ). Hence, (λxa)θ = λxaθ. We must prove that (λxaθ)w R bθw. By β-reduction, (λxaθ)w R aθxw . By induction hypothesis, aθxw R (bx)θxw . Since x ∈ / FV(b) ∪ dom(θ) ∪ codom(θ), (bx)θxw = bθw. (>red) By induction hypothesis and since →β ⊆ R . (>trans) By induction hypothesis and transitivity of R .

By property (C2) and Lemma 4, it follows that → = →β ∪ →R is well-founded if, for all rule f l → r ∈ R, r ∈ CCf> (l). Note that we could strengthen the deﬁnition of (>l )l∈T by taking in (>base), when l = f l, b ∈ CCf> (l) instead of b ∈ X \ FV(l), making the deﬁnitions of > and CC> mutually dependent. See [7] for details.

82

8

F. Blanqui

The Recursive Computability Ordering

We now show how the computability closure can be turned into a well-founded ordering containing the monomorphic version of Jean-Pierre Jouannaud and Albert Rubio’s higher-order recursive path ordering [25]. Indeed, consider the relation CR(>) = {(f l, r) | r ∈ CCf> (l), FV(r) ⊆ FV(l), τ (f l) = τ (r)} made of all the rules which right-hand side is in the computability closure of its left-hand side. After (C2) and Lemma 3, →β ∪ →CR(>) is well-founded whenever > is well-founded and stable by substitution. Hence, CR(>) is itself well-founded and stable by substitution whenever > is wellfounded and stable by substitution. We now observe that the function mapping > to CR(>) is monotone wrt inclusion. It has therefore a least ﬁxpoint that is stable by substitution and which closure by context is well-founded when combined with →β . Lemma 12. The function mapping > to the relation CR(>) = {(f l, r) | r ∈ CCf> (l), FV(r) ⊆ FV(l), τ (f l) = τ (r)} is monotone wrt inclusion on the set of well-founded relations stable by substitution. Proof. Assume that >1 ⊆ >2 . One can prove by induction on (f l, r) ∈ CR(>1 ) that (f l, r) ∈ CR(>2 ). In the (call) case, we use the fact that the function mapping > to >stat is monotone wrt inclusion. Now, assume that > is well-founded and stable by substitution. After (C2) and Lemma 3, →β ∪ →CR(>) is well-founded. Thus, CR(>) is well-founded. Now, one can check that CR(>) is stable by substitution whenever > is stable by substitution.

Definition 10. Let the weak higher-order recursive computability (quasi-) ordering >whorco be the least fixpoint of CR, and the higher-order recursive computability (quasi-) ordering >horco be the closure by context of >whorco . In Figure 4, we give an inductive presentation of >horco obtained by replacing u ∈ CCf> (l) by f l > u in Figure 1, and adding a rule (cont) for the closure by context and a rule (rule) for the conditions on rules. Strictly speaking, >horco , like >horpo , is not a quasi-ordering. One needs to take its transitive closure to get a quasi-ordering. On the other hand, one can check that >whorco is transitive, hence is a true quasi-ordering (note that, if t >whorco u, then t is of the form f t). Moreover, since >whorco is not closed by context, it is better suited for proving the termination of rewrite systems by using the dependency pair method [1,42,3]. We now would like to compare this ordering with the monomorphic version of >horpo which deﬁnition is reminded in Figure 5. To this end, we need to slightly strengthen the deﬁnition of computability closure by replacing > by its closure by context →> , and by adding the following deduction rule: (red)

u ∈ CCf> (l) v∈

u>v

CCf> (l)

Computability Closure: Ten Years Later

t >whorco u p ∈ Pos(C) C[t]p >horco C[u]p

(cont) (rule)

tT > uU

FV(u) ⊆ FV(t) t >whorco u

(arg)

(prec) f F g U ⇒U

T =U

f l > li f l > gu i ∈ Acc(g) f l > ui

(decomp-symb)

(call)

83

f >F g fl > g

f l > uU l (>whorco )statf u f l > gu

f l > uV ⇒T f l > v V f l > uv

(app)

(var)

x∈ / FV(l) fl > x

fl > u x ∈ / FV(l) f l > λxu

(lam)

Fig. 4. Higher-order computability ordering

One can check that all the properties are preserved. More details can be found in [7]. Hence, we get the following additional deduction rules for >whorco : (call)

f F g U ⇒U

(red)

f l > uU l (>horco )statf u f l > gu

f l > u u >horco v fl > v

We now prove that >horpo is included in the transitive closure of >horco . Lemma 13. >horpo ⊆ >+ horco . Proof. Note that FV(u) ⊆ FV(t) and T = U whenever tT >horpo uU (>horpo is a set of rules). We ﬁrst prove the property (*): f t > v whenever tj >∗horco v or f t >+ horco v. Assume that tj >∗horco v. By (arg), f t > tj . Thus, by (red), f t > v. Assume now that f t >horco u >∗horco v. By (red), it suﬃces to prove that f t > u. There are two cases: – f t = f atk b, u = f atk b and tk >horco tk . We conclude by (call). – f t = f lb, u = rb and f l > whorco r. One can check that f lt > rt whenever f l > r.

84

F. Blanqui

P (f, t, u) = f t >horpo u ∨ (∃j) tj ≥horpo u (1)

f >F g P (f, t, u) >horpo g U ⇒T uU

(2) (3) (4)

f T ⇒T tT

f F g

f F g

statf = mul t (>horpo )statf u f T ⇒T tT >horpo g U ⇒T uU

statf = lex t (>horpo )statf u f T ⇒T tT >horpo g U ⇒T uU (5)

(6)

ti ≥horpo u f T ⇒T tT >horpo uT

P (f, t, u)

P (f, t, u) f T ⇒T t >horpo uT

{t1 , t2 } (>horpo )mul {u1 , u2 } ⇒T U tU t2 >horpo uV1 ⇒T uV2 1 (7)

t >horpo u λxt >horpo λxu

Fig. 5. HORPO [25]

We now prove the theorem by induction on >horpo. (1) By induction hypothesis, ti >∗horco u. By (arg), f t > ti . Since ti >horpo u and f t >horpo u, f t → ti is a rule. Thus, f t >whorco ti and, by (red), f t >whorco u. ∗ (2) By induction hypothesis, for all i, f t >+ horco ui or tj >horco ui . Hence, by (*), f t > u. By (prec), f t > g. Thus, by (app), f t > gu. Since f t → gu is a rule, f t >whorco gu. (3) By induction hypothesis, t (>+ horco )mul u. Hence, by (*), f t > u. Thus, by (call), f t > gu. Since f t → gu is a rule, f t >whorco gu. + (4) By induction hypothesis, t (>+ horco )statf u and, for all i, f t >horco ui or tj >∗horco ui . Hence, by (*), f t > u. Thus, by (call), f t > gu. Since f t → gu is a rule, f t >whorco gu. ∗ (5) By induction hypothesis, for all i, f t >+ horco ui or tj >horco ui . Hence, by (*), f t > ui for all i. Thus, by (app), f t > u. Since (f t, u) is a rule, f t >whorco u. (6) For typing reasons, (t1 , u1) (>horpo )prod (t2 , u2 ). Thus, by induction hypothesis, (t1 , u1 ) (>+ horco )prod (t2 , u2 ). Hence, by (cont) and transitivity, u u . t1 t2 > + 1 2 horco + (7) By induction hypothesis, t >+

horco u. Thus, by (cont), λxt >horco λxu.

Computability Closure: Ten Years Later

85

We observe that, if (6) were restricted to (t1 >horpo u1 ∧ t2 = u2 ) ∨ (t1 = u1 ∧ t2 >horpo u2 ), then we would get >horpo ⊆ >horco , since this is the only case requiring transitivity. Note that >horco can be extended with the accessibility ordering deﬁned in Figure 3. The details can be found in [7]. Finally, we remark that, when restricted to ﬁrst-order terms, the recursive computability ordering is equal to the usual ﬁrst-order recursive path ordering [41,14], the subterm rule being simulated by (arg) and (red). Lemma 14. The relation defined in Figure 4 by the rules (arg), (decomp-symb), (call) and the rule: (prec-app)

f >F g U ⇒U f l > uU f l > gu

is equal to the usual first-order recursive path ordering.

9

Conclusion

We show through various extensions how powerful is the notion of computability closure introduced by Jean-Pierre Jouannaud and Mitsuhiro Okada. In particular, we show how it can easily be turned into a well-founded ordering containing Jean-Pierre Jouannaud and Albert Rubio’s higher-order recursive path ordering. This provides a simple way to extend this ordering to richer type disciplines. However, its deﬁnition as the closure by context of another relation is not completely satisfactory, all the more so since one wants to combine it with the accessibility ordering. We should therefore try to ﬁnd a new deﬁnition of HORPO that nicely integrates the notions of computability closure and accessibility ordering in order to capture deﬁnitions on higher-order data types (data types with constructors having functional recursive arguments).

References 1. Arts, T., Giesl, J.: Termination of term rewriting using dependency pairs. Theoretical Computer Science 236, 133–178 (2000) 2. Barendregt, H.: Lambda calculi with types. In: Abramsky, S., Gabbay, D., Maibaum, T. (eds.) Handbook of logic in computer science, vol. 2, Oxford University Press, Oxford, UK (1992) 3. Blanqui, F.: Higher-order dependency pairs. In: Proceedings of the 8th International Workshop on Termination (2006) 4. Blanqui, F.: Rewriting modulo in Deduction modulo. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706, Springer, Heidelberg (2003) 5. Blanqui, F.: Termination and conﬂuence of higher-order rewrite systems. In: Bachmair, L. (ed.) RTA 2000. LNCS, vol. 1833, Springer, Heidelberg (2000) 6. Blanqui, F.: Deﬁnitions by rewriting in the Calculus of Constructions. Mathematical Structures in Computer Science 15(1), 37–92 (2005)

86

F. Blanqui

7. Blanqui, F.: (HO) RPO revisited. Research Report 5972, INRIA (2006) 8. Blanqui, F., Jouannaud, J.-P., Okada, M.: The Calculus of Algebraic Constructions. In: Narendran, P., Rusinowitch, M. (eds.) RTA 1999. LNCS, vol. 1631, Springer, Heidelberg (1999) 9. Blanqui, F., Jouannaud, J.-P., Okada, M.: Inductive-data-type Systems. Theoretical Computer Science 272, 41–68 (2002) 10. Breazu-Tannen,V.: Combining algebra and higher-order types. In: Proceedings of the 3rd IEEE Symposium on Logic in Computer Science (1988) 11. Breazu-Tannen, V., Gallier, J.: Polymorphic rewriting conserves algebraic strong normalization. In: Della Rocca, S.R., Ausiello, G., Dezani-Ciancaglini, M. (eds.) ICALP 1989, LNCS, vol. 372, Springer, Heidelberg (1989) 12. Breazu-Tannen, V., Gallier, J.: Polymorphic rewriting conserves algebraic strong normalization. Theoretical Computer Science 83(1), 3–28 (1991) 13. Breazu-Tannen, V., Gallier, J.: Polymorphic rewriting conserves algebraic conﬂuence. Information and Computation 114(1), 1–29 (1994) 14. Dershowitz, N.: Orderings for term rewriting systems. Theoretical Computer Science 17, 279–301 (1982) 15. Dershowitz, N., Jouannaud, J.-P.: Rewrite systems. In: van Leeuwen, J. (ed.) Handbook of Theoretical Computer Science, vol. B, ch.6. North-Holland, Amsterdam (1990) 16. Dougherty, D.: Adding algebraic rewriting to the untyped lambda calculus. In: Book, R.V. (ed.) RTA 1996, LNCS, vol. 488, Springer, Heidelberg (1991) 17. Dougherty, D.: Adding algebraic rewriting to the untyped lambda calculus. Information and Computation 101(2), 251–267 (1992) 18. Girard, J.-Y.: Une extension de l’interprétation de Gödel à l’analyse et son application à l’élimination des coupures dans l’analyse et la théorie des types. In: Fenstad, J. (ed) Proc. of the 2nd Scandinavian Logic Symposium. Studies in Logic and the Foundations of Mathematics, vol. 63. North-Holland, Amsterdam (1971) 19. Girard, J.-Y.: Interprétation fonctionelle et élimination des coupures dans l’arithmetique d’ordre supérieur. PhD thesis, Université Paris VII, France (1972) 20. Girard, J.-Y., Lafont, Y., Taylor, P.: Proofs and Types. Cambridge University Press, Cambridge (1988) 21. Jouannaud, J.-P., Kirchner, H.: Completion of a set of rules modulo a set of equations. SIAM Journal on Computing 15(4), 1155–1194 (1986) 22. Jouannaud, J.-P., Okada, M.: Executable higher-order algebraic speciﬁcation languages. In: Proceedings of the 6th IEEE Symposium on Logic in Computer Science (1991) 23. Jouannaud, J.-P., Okada, M.: Abstract Data Type Systems. Theoretical Computer Science 173(2), 349–391 (1997) 24. Jouannaud, J.-P., Rubio, A.: Higher-order orderings for normal rewriting. In: Pfenning, F. (ed.) RTA 2006. LNCS, vol. 4098, Springer, Heidelberg (2006) 25. Jouannaud, J.-P., Rubio, A.: The Higher-Order Recursive Path Ordering. In: Proceedings of the 14th IEEE Symposium on Logic in Computer Science (1999) 26. Jouannaud, J.-P., Rubio, A.: A recursive path ordering for higher-order terms in eta-long beta-normal form. In: Ganzinger, H. (ed.) RTA 1996. LNCS, vol. 1103, Springer, Heidelberg (1996) 27. Khasidashvili, Z.: Expression Reduction Systems. In: Proc. of I. Vekua Institute of Applied Mathematics, vol. 36 (1990) 28. Klop, J. W.: Combinatory Reduction Systems PhD thesis, Utrecht Universiteit, The Netherlands, Published as Mathematical Center Tract 129 (1980)

Computability Closure: Ten Years Later

87

29. Klop, J.W., van Oostrom, V., van Raamsdonk, F.: Combinatory reduction systems: introduction and survey. Theoretical Computer Science 121, 279–308 (1993) 30. Kruskal, J.B.: Well-quasi-ordering, the tree theorem, and vazsonyi’s conjecture. Transactions of the American Mathematical Society 95, 210–225 (1960) 31. Loria-Saenz, C., Steinbach, J.: Termination of combined (rewrite and λ-calculus) systems. In: Rusinowitch, M., Remy, J.-L. (eds.) CTRS 1992, LNCS, vol. 656, Springer, Heidelberg (1992) 32. Lysne, O., Piris, J.: A termination ordering for higher order rewrite systems. In: Hsiang, J. (ed.) RTA 1995, LNCS, vol. 914, Springer, Heidelberg (1995) 33. Mayr, R., Nipkow, T.: Higher-order rewrite systems and their conﬂuence. Theoretical Computer Science 192(2), 3–29 (1998) 34. Mendler, N. P.: Recursive types and type constraints in second order lambda calculus. In: Proceedings of the 2nd IEEE Symposium on Logic in Computer Science (1987) 35. Mendler, N.P.: Inductive types and type constraints in the second-order lambda calculus. Annals of Pure and Applied Logic 51(1-2), 159–172 (1991) 36. Miller, D.: A logic programming language with lambda-abstraction, function variables, and simple uniﬁcation. In: Schroeder-Heister, P. (ed.) ELP 1989, LNCS, vol. 475, Springer, Heidelberg (1989) 37. Miller, D.: A logic programming language with lambda-abstraction, function variables, and simple uniﬁcation. Journal of Logic and Computation 1(4), 497–536 (1991) 38. Miller, D., Nadathur, G.: An overview of λProlog. In: Proceedings of the 5th International Conference on Logic Programming. MIT Press, Cambridge, MA (1988) 39. Nipkow, T.: Higher-order critical pairs. In: Proceedings of the 6th IEEE Symposium on Logic in Computer Science (1991) 40. Okada, M.: Strong normalizability for the combined system of the typed lambda calculus and an arbitrary convergent term rewrite system. In: Proceedings of the 1989 International Symposium on Symbolic and Algebraic Computation. ACM Press, New York (1989) 41. Plaisted, D.A.: A recursively deﬁned ordering for proving termination of term rewriting systems. Technical report, University of Illinois, Urbana-Champaign, United States (1978) 42. Sakai, M., Kusakari, K.: On new dependency pair method for proving termination of higher-order rewrite systems. In: Proceedings of the 1st International Workshop on Rewriting in Proof and Computation (2001) 43. Tait, W.W.: Intensional interpretations of functionals of ﬁnite type I. Journal of Symbolic Logic 32(2), 198–212 (1967) 44. Tait, W.W.: A realizability interpretation of the theory of species. In: Parikh, R. (eds.) Proceedings of the 1972 Logic Colloquium. Lecture Notes in Mathematics, vol. 453. Springer, Heidelberg (1975) 45. van de Pol, J.: Termination proofs for higher-order rewrite systems. In: Heering, J., Meinke, K., Möller, B., Nipkow, T. (eds.) HOA 1993. LNCS, vol. 816, Springer, Heidelberg (1993) 46. van Oostrom, V.: Development closed critical pairs. In: Dowek, G., Heering, J., Meinke, K., Möller, B. (eds.) HOA 1995. LNCS, vol. 1074, Springer, Heidelberg (1995) 47. van Oostrom, V.: Conﬂuence for Abstract and Higher-Order Rewriting. PhD thesis, Vrije Universiteit Amsterdam, The Netherlands (1994) 48. Peterson, G., Stickel, M.: Complete sets of reductions for some equational theories. Journal of the ACM 28(2), 233–264 (1981)

88

F. Blanqui

49. van Raamsdonk, F.: Conﬂuence and Normalization for Higher-Order Rewriting. PhD thesis, Vrije University Amsterdam, The Netherlands (1996) 50. Walukiewicz-Chrząszcz, D.: Termination of Rewriting in the Calculus of Constructions. PhD thesis, Warsaw University, Poland and Université d’Orsay, France (2003) 51. Walukiewicz-Chrząszcz, D.: Termination of rewriting in the Calculus of Constructions. Journal of Functional Programming 13(2), 339–414 (2003)

Reduction Strategies and Acyclicity Jan Willem Klop1,2,3 , Vincent van Oostrom4, and Femke van Raamsdonk1 1

Vrije Universiteit, Department of Theoretical Computer Science, De Boelelaan 1081a, 1081 HV Amsterdam, The Netherlands 2 Radboud Universiteit Nijmegen, Department of Computer Science, Toernooiveld 1, 6525 ED Nijmegen, The Netherlands 3 CWI, P.O. Box 94079, 1090 GB Amsterdam, The Netherlands 4 Universiteit Utrecht, Department of Philosophy, Heidelberglaan 8, 3584 CS Utrecht, The Netherlands [email protected], [email protected], [email protected]

Abstract. In this paper we review some well-known theory about reduction strategies of various kinds: normalizing, outermost-fair, coﬁnal, Church-Rosser. A stumbling block in the deﬁnition of such strategies is the presence of reduction cycles that may ‘trap’ a strategy as it is memory-free. We exploit a recently (re)discovered fact that there are no reduction cycles in orthogonal rewrite systems when each term has a normal form, in order to enhance some of the theorems on strategies, both with respect to their scope and the proof of their correctness.

Dedicated to Jean-Pierre Jouannaud on the occasion of his 60th birthday

1

Introduction

The general objective of our note is to survey some fundamental theorems about reduction strategies in term rewriting, both ﬁrst-order and higher-order. Some of these theorems are by now rather classical, and some are of a more recent date. The strategies serve various purposes: they may be normalizing, or outermostfair, or coﬁnal, or Church-Rosser strategies, to name some of their more important properties. One liability they have in common: they may fall into a trap formed by a reduction cycle. This is so because the usual notion of a reduction strategy is such that no memory is involved: a reduction strategy F is just a function from terms to terms, such that for every term t that is not in normal form we have t → F(t) in case F is a one-step strategy, and t → → F(t) in case F is a many-step strategy. Thus, if we have for a one-step strategy F that e.g. F3 (t)≡t (see Figure 1), then F will be forever trapped in this reduction cycle t → F(t) → F(F(t)) → t The danger of a strategy being trapped in a reduction cycle is apparent in the proofs of several theorems about strategies. E.g. avoiding cycles is prominent in H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 89–112, 2007. c Springer-Verlag Berlin Heidelberg 2007

90

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

F(t) = F4(t) = F7(t) = ... F2(t) = F5(t) = F8(t) = ...

t = F3(t) = F6(t) = ... Fig. 1. Trap

the proof that there exists a computable many-step Church-Rosser strategy for λcalculus [5,3], discussed in Section 6. And avoiding cycles is a major complicating factor in Statman’s deﬁnition of a coﬁnal strategy for combinators [14]. Now recently it was found by Ketema et al. [7] that under very natural conditions there are no reduction cycles at all. Of course, if the rewrite system has the property SN, strong normalization (or termination), there are no reduction cycles. But this is a bit too strong. Ketema et al. [7] proved that for orthogonal term rewriting systems that are WN, weakly normalizing, there are already no cycles, a property that we indicate by AC (acyclicity). This theorem generalizes to a wide class of rewrite systems, namely the weakly orthogonal fully extended higher-order rewriting systems. Actually, this theorem was for the case of almost orthogonal combinatory reduction systems already proved in a rather implicit way in Kennaway [6], but there it has remained unnoticed until now. Combining our ﬁrst observation of the ‘cycle trap’ for strategies with this recent insight that we have WN ⇒ AC for orthogonal rewrite systems, there arises a natural question: does the acyclicity of orthogonal systems that are WN facilitate the proofs of the theorems for reduction strategies that are in the literature? The goal of our note is to show that the answer is aﬃrmative. In doing so, we obtain a strengthening of some of the theorems known for strategies, and a simpliﬁcation of some of their proofs. We also present some new theorems. Finally, we employ in our formulation a notion of strategy, based on abstract rewriting notions, that is more expressive than the classical (functional) notion.

2 2.1

Basic Notions Abstract Rewriting

We start by introducing the necessary notions and notations concerning abstract rewriting, where the objects that are rewritten do not have any observable structure. One of the usual deﬁnitions of abstract rewriting is as a set equipped with

Reduction Strategies and Acyclicity

91

a binary relation (as in [2, p.7], and as a special case of [15, Deﬁnition 1.1.1]). Here we take another approach, via the more expressive notion of ARS as in [15, Deﬁnition 8.2.2], where steps are ﬁrst-class citizens. Deﬁnition 1. An abstract reduction system (ARS) is deﬁned as a quadruple (A, Φ, source, target) where A is a set of objects, Φ a set of steps, and source : Φ → A and target : Φ → A are functions mapping a step to its source and target. ARSs are denoted by →, ⇒, . . ., and also by A, B, S, F, . . .. We can think of an ARS as a graph. There might be more than one step between two objects, so we can express more than binary relations on a set. Example 1. See also Figure 2. (i) The ARS A1 = (A1 , Φ1 , source1 , target1 ) is deﬁned by: A1 = {a, b}, Φ1 = {φ1 , φ2 }, source1 (φ1 ) = a, target1 (φ1 ) = a, source1 (φ2 ) = a, target1 (φ2 ) = b. (ii) The ARS A2 = (A2 , Φ2 , source2 , target2 ) is deﬁned by: A2 = {a, b}, Φ2 = {φ1 }, source2 (φ1 ) = a, target2 (φ1 ) = a. So the underlying graph of an ARS is not necessarily connected. (iii) The ARS A3 = (A3 , Φ3 , source3 , target3 ) is deﬁned by: A3 = {a, b}, Φ3 = {φ2 }, source3 (φ2 ) = a, target3 (φ2 ) = b. (iv) The ARS A4 = (A4 , Φ4 , source4 , target4 ) is deﬁned by: A4 = {a, b}, Φ4 = {φ2 , φ3 }, source4 (φ2 ) = source4 (φ3 ) = a, target4 (φ2 ) = target4 (φ3 ) = b. In A4 there are two diﬀerent steps from a to b, hence it cannot be given as a relation on a set. This phenomenon occurs for instance in λ-calculus with β-reduction: there are two diﬀerent steps from I (I I) to I I. (v) The well-known counter-example against the implication ‘local conﬂuence implies conﬂuence’ is deﬁned as the following ARS A5 : A = {a, b, c, d}, Φ = {φ1 , φ2 , φ3 , φ4 }, source(φ1 ) = b, target(φ1 ) = a, source(φ2 ) = b, target(φ2 ) = c, source(φ3 ) = c, target(φ3 ) = b, source(φ4 ) = c, target(φ4 ) = d. In some of the examples in the paper, we will write ARSs in a simpliﬁed notation, namely as a set of arrows with source and target. It is then understood that the set of objects is the set of objects mentioned, and that source and target are as suggested by the explicit enumeration of the arrows. For instance the ARS A5 from Example 1 is then written as {b → a, b → c, c → b, c → d}. The deﬁnition of strategy below employs the following deﬁnition of sub-ARS. Deﬁnition 2. An ARS A1 = (A1 , Φ1 , source1 , target1 ) is a sub-ARS of an ARS A2 = (A2 , Φ2 , source2 , target2 ), notation A1 ⊆ A2 , if the following holds: (i) A1 ⊆ A2 , (ii) Φ1 ⊆ Φ2 , (iii) source1 and target1 are the restrictions of source2 and target2 to Φ1 . If we think of an ARS as a graph, a sub-ARS is a sub-graph, with possibly less objects and less steps. The last condition of the deﬁnition of sub-ARS implies

92

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

a

2

b

a

1

b

a

(ii)

3

b

(iii)

a

2 (iv)

b

1

(i)

a

2

1

b

3

c

4

d

2 (v)

Fig. 2. The ARSs from Example 1

that source(Φ1 ) ⊆ A1 and also target(Φ1 ) ⊆ A1 , that is, the sources and targets of steps in the small ARS must be present in its set of objects. Note that ⊆ is a partial order on ARSs. The deﬁnition of sub-ARS used here is diﬀerent from for instance [15, Deﬁnition 1.1.6]: there the set of objects of the ‘small’ ARS must be closed under the steps of the ‘big’ ARS. See also the example below. Example 2. (i) An ARS is a sub-ARS of itself: A ⊆ A. (ii) For the ARSs deﬁned of Example 1 we have: A2 ⊆ A1 , A3 ⊆ A1 , A3 ⊆ A4 . (iii) There is no sub-ARS of the ARS A3 from Example 1 with ∅ as set of objects, and {φ2 } as set of steps. (iv) The ARS a without any steps is a sub-ARS of a → b. So the set of objects of the ‘small’ ARS need not to be closed under the reduction of the ‘big’ ARS. In the remainder of this subsection we assume an ARS A = (A, Φ, source, target). A reduction step or rewrite step is an element of Φ, together with its source and target. Reduction steps are written as φ : a → b or a →φ b, for a step φ ∈ Φ. An object a ∈ A is a normal form (or a is in normal form) if there is no reduction step a → with source a. A reduction or rewrite sequence starting in a0 is a ﬁnite or inﬁnite sequence of steps: a0 →φ0 a1 →φ1 a2 →φ2 . . .. A ﬁnite reduction a0 →φ0 . . . →φn−1 an is said to be a reduction from a0 to an . Such → an . A reduction is said to be maximal if it a reduction is also written as a0 → cannot be extended, that is, either it ends in a normal form or it is inﬁnite. We sometimes omit irrelevant information from this notation, writing for instance a → to indicate that there is a step from a, or a → → to indicate a ﬁnite or inﬁnite reduction starting in a. If we want to stress that a step (or reduction) takes place in the ARS A we use A as subscript. The reduction graph of a in A, notation G(a, A), has as set of objects {b | a → → b}, and as set of steps all φ ∈ Φ with source(φ) ∈ {b | a → → b}. Further, the source

Reduction Strategies and Acyclicity

93

and target functions of G(a, A) are the appropriate restrictions of source and target. A reduction graph is a sub-ARS of A. An object a ∈ A is weakly normalizing in A, notation a ∈ WN(A), if there is a reduction sequence in A from a to a normal form of A. The ARS A is weakly normalizing, notation A ∈ WN, if all objects a ∈ A are weakly normalizing in A. An object a ∈ A is strongly normalizing in A or terminating in A, notation a ∈ SN(A), if all reduction sequences starting in a are ﬁnite. The ARS A is strongly normalizing or terminating, notation A ∈ SN, if all objects a ∈ A are strongly normalizing in A. It may happen that an object is weakly normalizing in an ARS but not in a sub-ARS. For example, considering the ARSs of Example 1, we have a ∈ WN(A1 ), but a is not weakly normalizing in A2 ⊆ A1 . The ARS A is conﬂuent if the endpoints of all pairs of co-initial reductions → b and a → → b then b ↓A b . are joinable, so for all objects a, b, b ∈ A: if a → 2.2

Term Rewriting

We use the standard notions and notations from [2,15] for ﬁrst-order term rewriting systems (TRSs). We also consider higher-order rewriting systems with patterns (HRSs), deﬁned by Nipkow [11]. At some places in the literature these are called PRSs. The terms are simply typed λ-terms with constants, that are considered modulo αβη. Rules satisfy the patterns restriction that guarantees matching (and uniﬁcation) modulo βη to be decidable. See also [15, Chapter 11] for deﬁnitions and notations. A term rewriting system is orthogonal if all rewrite rules are left-linear and there are no critical pairs. A term rewriting system is weakly orthogonal if all rewrite rules are left-linear and all critical pairs are trivial (so overlapping steps yield the same result). Almost orthogonal is in between orthogonal and weakly orthogonal: trivial critical pairs are allowed but only if the overlap is at the top. Deﬁnition 3. A rewrite rule is fully extended if in the left-hand side every free variable has as arguments exactly all variables that are bound at that position. In fully extended systems, whether a rule is applicable does not depend on whether or not a bound variable occurs. The rewrite rule f (λx. z) → a with z a free variable is not fully extended. The rule can only be applied to a term of the form f (λx.s) if x does not occur in s. Another example of a rule that is not fully extended is the η-reduction rule: λx.M x → M , with the side-condition that x should not occur in the free variables of M . 2.3

Reduction Strategies

A common approach in the literature is that a strategy, intuitively speaking, tells us how to reduce a term. That is, a strategy tells us how we must reduce a term. Then a strategy is a function from terms to terms, and hence deterministic, as in the Introduction. But we can also adopt a more general point of view: a strategy tells us how we may reduce a term. Following [15, Deﬁnition 9.1.1], see also [16], we take the latter approach.

94

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

Deﬁnition 4. A strategy for an ARS → is a sub-ARS of → having the same objects and normal forms. So a strategy has the same objects as the original ARS, but possibly less arrows. Also, an object is a normal form in the strategy exactly if it is a normal form in the original ARS. The explanation for the requirement that a strategy has the same normal forms as the original ARS is that we want the strategy to be ‘pushy’: whenever there are still possibilities (steps, edges) to proceed, the strategy will select a positive number of them, and not discard them all. So a strategy can only stop in a normal form, but not before. Note that ‘strategy for’ is transitive: a strategy S for a strategy S for an ARS A is again a strategy for A. Thus we have a notion of reﬁnement of strategies. Example 3. (i) An ARS is a strategy for itself. In fact, this is the strategy of exhaustive search. This also shows that a strategy may be non-deterministic. ← (ii) We consider the following ARS A from [15, Example 9.1.2]: a → b → c. Then a → b → c is a strategy for A. The sub-ARS b → c is not a strategy for A, because it does not have the same objects as A. The sub-ARS a ← b → c is not a strategy for A either, because a is not a normal form in A. (iii) We reconsider the ARSs of Example 1. A2 and A3 are both strategies for A1 . Also, A3 is a strategy for A4 . (iv) Consider following ARS: B = {a → b, a → c, a → d, d → d}. Then S = {a → b, a → c, d → d} is a non-deterministic strategy for B. Properties of strategies. A strategy is usually employed to obtain a reduction with a certain property. Deﬁnition 5. Let S be a strategy for A = (A, Φ, source, target). (i) S is normalizing if a ∈ SN(S) for every object a ∈ WN(A). (ii) S is coﬁnal if the following holds: for every a ∈ A, for every ﬁnite reduction → in S, there is an R : a → → a in A, for every maximal reduction S : a → → c in A. See Figure 3. object c in S such that a → In Example 1, the ARS A3 is a normalizing strategy for A1 . An ARS is not necessarily a coﬁnal strategy for itself. For instance, in the ARS A1 of Example 1 the ﬁnal object b of the reduction a → b cannot be reduced to an object in the maximal reduction a → a → a → . . .. Also in this possibly non-deterministic setting coﬁnal strategies are normalizing [15, Proposition 9.1.16]. Proposition 1 ([15]). Coﬁnal strategies are normalizing. Church-Rosser strategies. We now focus on a subclass of strategies. A strategy is said to be deterministic or functional if every object is the source of at most one arrow. Reconsidering the ARSs of Example 1, both A2 and A3 are functional strategies for A. The ARS A1 is also a strategy for itself, which is not functional.

Reduction Strategies and Acyclicity

95

a R S a’

S c

Fig. 3. A coﬁnal strategy

A function from terms to terms that maps a normal form to itself, and a term that is not in normal form to one of its one-step reducts, naturally induces a deterministic (or functional) strategy. Therefore we use in the setting of functional strategies also the notation Fn (a) for the object reached by performing n steps according to F, starting in a (with F(a) ≡ a if a is in normal form). Deﬁnition 6. A deterministic (or functional) strategy F for an ARS A is said to be a Church-Rosser strategy for A, also called a CR-strategy for A, if the following holds: if a =A b then ∃n, m ∈ N : Fn (a) ≡ Fm (b). See also Figure 4.

a

b

F(a) F2 (a)

F(b) F2 (b)

Fn(a) Fn+1(a)

Fm(b) Fm+1(b)

Fig. 4. One-step CR-strategy

In Section 6 we will also consider many-step functional Church-Rosser strategies, where intuitively a term not in normal form is mapped to some reduct (where the reduct is reached in at least one step). Overview of properties of strategies. We conclude this section with a picture (Figure 5) of properties of reduction strategies, for abstract rewriting and term rewriting, and their interrelations. The notions fair and leftmost-fair are included for completeness and do not play a rˆ ole in the remainder of the paper. The implication ‘coﬁnal implies normalizing’ is Proposition 1. The implication ‘ChurchRosser implies coﬁnal’ is Theorem 8, which is concerned with functional (or

96

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

deterministic) strategies. The implication ‘normalizing implies Church-Rosser’ holds for functional strategies in weakly normalizing and conﬂuent ARSs: a normalizing strategy then yields a common reduct of two convertible objects by computing their normal forms, which are the same. The implication ‘outermostfair implies normalizing’ is Theorem 7, which is concerned with the more general setting of weakly orthogonal and fully extended HRSs.

abstract strategies

term strategies for orthogonal TRSs fair

Church-Rosser

cofinal

outermost fair

leftmost fair

if WN and CR

if left-normal normalizing

Fig. 5. Overview of reduction strategies

3

A Normalizing Strategy

A normalizing strategy is of interest in the case that a rewriting system has terms that can be rewritten to normal form, but are also the starting point of an inﬁnite reduction. This happens for instance to the term K I ((S I I) (S I I)) in Combinatory Logic (CL) which is deﬁned by the rewrite rules Ix →x Kxy → x S x y z → x z (y z) For (pure) CL the leftmost-outermost strategy is normalizing. But let us now consider CL extended with Gustave’s term rewriting system which is deﬁned by the following rules: g(a, b, x) → c g(x, a, b) → c g(b, x, a) → c How should we evaluate a term of the form g(l, m, r) with l, m, and r redexes of (pure) CL? Such a term intuitively seems to require parallel evaluation because

Reduction Strategies and Acyclicity

97

it is undecidable whether a CL term has a (head) normal form. Nevertheless, Kennaway [6] proves, surprisingly, that there is a normalizing one-step strategy for the combination of CL and Gustave’s TRS. More precisely, Kennaway proves that almost orthogonal Combinatory Reduction Systems (CRSs) have a computable one-step normalizing strategy. This means that also λ-calculus with parallel-or, deﬁned by (λx. z) z por(t, z) por(z, t) por(f, f)

→ z[x := z ] →t →t →f

has a computable one-step normalizing strategy, although intuitively it seems that a term por(M, N ) with M and N λ-terms requires a parallel evaluation. Antoy and Middeldorp [1] deﬁne a computable one-step strategy for almost orthogonal term rewriting systems, and show that it is normalizing via a reduction to normalization of outermost-fair rewriting. In this section we present two observations concerning their strategy. The ﬁrst observation is that the deﬁnition of the strategy, and the proof of its normalization, can be extended to the case of fully extended weakly orthogonal higher-order rewriting. The second observation is that the deﬁnition of the strategy can be made substantially simpler for weakly normalizing systems, because then we do not have to deal with cycles. The strategy SF . We deﬁne a non-deterministic strategy SF for higher-order rewriting. The deﬁnition is a minor adaptation of the deﬁnition by Antoy and Middeldorp [1]. We use the notation SF from [15]; the notation used in [1] is Sω . In the deﬁnition of SF for higher-order rewriting we make use of the notion ‘acyclicity-check’. In general, it is undecidable whether a term cycles. However, for ﬁnite systems, it is decidable whether a term t cycles within its own height, that is, is on a cycle where all terms are at most as big as t itself. More in particular, it is also decidable whether a terms cycles according to a strategy within its own height. Deﬁnition 7. Assume a HRS R. The strategy SF and the property ACSF of passing the SF -acyclicity-check are deﬁned by induction on the structure of terms as follows: (i) Given a term s, the strategy SF can perform the following steps: (a) if s is a redex, then SF can only contract a redex at the root, (a) otherwise, SF is applied to a smallest direct argument satisfying ACSF , (a) otherwise, SF can perform any step. (ii) A term t satisﬁes ACSF , or otherwise said passes the SF -acyclicity-check, if it is not on a SF -cycle in which all terms are at most as big as t. Otherwise, it fails the acyclicity-check. The strategy SF is an outermost strategy that is only unfair to redexes that intuitively do not contribute to the normal form because they cycle. Below (Theorem 1) we show that SF is normalizing.

98

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

Note that in the deﬁnition of SF -acyclicity-check for a term t, we only need the deﬁnition of SF on terms smaller than t. Since overlap is allowed, a redex at the root is not necessarily unique. Further, SF is a non-deterministic strategy. If the ﬁrst clause of the deﬁnition applies, then there is possibly a choice between overlapping root-redexes. If the second clause of the deﬁnition applies, there is a choice between all smallest reducible arguments that pass the SF -acyclicity-check. In addition, there might be a choice between overlapping redexes. Example 4. We consider the orthogonal TRS deﬁned by the following rules: f (x, g (y), h (z)) → b a →a b → g(g(b)) g(x) → g (x) h(x) → h (x) An example of a reduction according to SF : f (a, b, h(b)) → the argument a fails the acyclicity-check b is the smallest reducible argument passing the acyclicity-check f (a, g(g(b)), h(b)) → h(b) is the smallest reducible argument passing the acyclicity-check f (a, g(g(b)), h (b)) → h (b) is the smallest reducible argument passing the acyclicity-check f (a, g(g(b)), h (g(g(b)))) → g(g(b)) is the smallest reducible argument passing the acyclicity-check f (a, g (g(b)), h (b)) → there is a root-redex b The strategy SF skips arguments that are SF -cyclic within their own height. One might wonder whether we could skip more arguments, while remaining normalizing. The following examples shows that skipping arguments that are cyclic (but not necessarily SF -cyclic) destroys normalization of SF . Example 5. We consider the orthogonal TRS deﬁned by the following rules: a →b c →c g(b, y) → d h(d, y) → e The term h(g(a, c), c) has a normal form which is indeed found in the following SF -rewrite sequence: h(g(a, c), c) → h(g(b, c), c) → h(d, c) → e However, if we adapt the deﬁnition of the strategy in the sense that we skip arguments that cycle within their own height, then we skip the argument g(a, c)

Reduction Strategies and Acyclicity

99

because g(a, c) → g(a, c), and we also skip the argument c because c → c. In other words, both arguments are skipped, and the third clause of the deﬁnition of the strategy applies. That is, also h(g(a, c), c) → h(g(a, c), c) → . . . is a rewrite sequence according to the strategy. So this adaptation yields a strategy that is not normalizing. One might also wonder whether we could skip fewer arguments, while remaining normalizing. The following example shows that skipping arguments if all their reductions are cyclic within their own height (so an argument that is SF -cyclic within its own height but also has another reduction is not skipped anymore) destroys normalization of SF . Example 6. We consider the orthogonal TRS deﬁned by the following rules: a → f (a) g(x) → g(x) h(x) → h (x) j(h (x), y) → b The term j(h(h(x)), g(a)) has a normal form. Indeed the following SF -rewrite sequence ﬁnds the normal form: j(h(h(x)), g(a)) → j(h (h(x)), g(a)) → b Note that the argument g(a) is skipped because it is SF -cyclic within its own height. However, if we adapt the deﬁnition of the strategy by skipping arguments if all their reductions are cyclic within their own height, then the argument g(a) is no longer skipped. In that case we obtain the following rewrite sequence: j(h(h(x)), g(a)) → j(h(h(x)), g(a)) → . . . So this change in the condition on skipping arguments makes that the strategy is no longer normalizing. Normalization via outermost-fair rewriting. One can show that if the strategy SF fails to normalize a term s, then there is an inﬁnite outermost-fair rewrite sequence starting from s. Section 5 is concerned with outermost-fair rewriting and in particular contains the theorem that outermost-fair rewriting is normalizing for HRSs that are fully extended and weakly orthogonal from [13]. Theorem 1. Assume a fully extended and weakly orthogonal HRS. If there is an inﬁnite SF -rewrite sequence starting from s, then there is an inﬁnite outermostfair rewrite sequence starting from s. Proof. We only give the idea of the proof. Suppose that there is an inﬁnite SF rewrite sequence starting in s. An outermost redex that is unfairly treated is on a SF -cycle. Also, it is disjoint from other such redexes. A SF -cycle can be made outermost-fair. Now interleave the original inﬁnite SF -rewrite sequence repeatedly with extra reductions on the place of the cycles, to obtain an inﬁnite outermost-fair reduction starting in s.

100

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

Corollary 1. The strategy SF is a computable one-step normalizing strategy for HRSs that are weakly orthogonal and fully extended. Acyclic rewriting. A second observation is that for weakly normalizing systems, the acyclicity-check can be omitted, thanks to Theorem 6. The deﬁnition of the strategy then becomes more simple, and applying the strategy becomes essentially easier. is deDeﬁnition 8. Assume a weakly normalizing HRS R. The strategy SAC F ﬁned by induction on the structure of terms as follows. Given a term s, the can perform the following steps: strategy SAC F (i) if s is a redex, then SAC can only contract a redex at the root, F is applied to a smallest direct argument that is reducible. (ii) otherwise, SAC F We claim that SAC is outermost-fair. Hence by Theorem 7 it is normalizing. F

4

Acyclicity

As argued in this paper, for several strategies their computability is seen to rely on having a suitable cycle detection sub-routine available. As cycle detection is complex, it is interesting to look at rewrite systems which do not need it, i.e. which are acyclic. Then the sub-routine can simply answer: no, with a resulting simpliﬁcation, as exempliﬁed in Deﬁnition 8. In this section, we recapitulate some known acyclicity results and establish some new ones. The following two classical acyclicity results for Combinatory Logic (CL) are due to [9] and [5] respectively. Here we consider CL with basis {S, K, I} and the following applicative rewrite rules: Ix →x Kxy → x S x y z → x z (y z) Theorem 2 ([9]). In Combinatory Logic, every ﬁnite reduction graph is acyclic. This ‘ﬁnite acyclicity’ result is very much CL-speciﬁc. For instance, both the term a in the single-rule orthogonal TRS {a → a} as well as the term Ω = (λx.xx)(λx.xx) in the λ-calculus, have a single-node cyclic reduction graph. By the theorem, since the reduction graph of the direct translation SII(SII) of Ω into CL is cyclic: SII(SII) → →CL SII(SII) it can no longer be ﬁnite, and indeed it is not: SII(SII) → →CL I(SII(SII)) → →CL I(I(SII(SII))) → →CL . . .. Theorem 3 ([5]). In Combinatory Logic, S-terms are acyclic. As it brings out nicely the minimal counter-example technique commonly employed in acyclicity proofs, we now present an alternative proof to this result.

Reduction Strategies and Acyclicity

101

Proof. For a proof by contradiction, suppose a cycle σ : t t of minimal height would exist. By minimality σ is a head cycle, i.e. σ is of shape t S s u v → s v (u v) t. Observe no S-step decreases size and only doesn’t increase size if its third argument is an S. But then in the next head-step, the term size increases, because no term other than S reduces to S, in particular, u v does not reduce to S. Remark 1. Neither of Theorems 2 and 3 entails the other; S-terms may not be terminating and thus have inﬁnite reduction graphs, 1 and the example SII(SII) above shows that general CL-terms need not be acyclic. It could be diﬃcult to ﬁnd a common generalization, since the former result is even dependent on the particular basis chosen (here {S, K, I}) as noted in [5]. Next we present two results allowing to infer acyclicity of a system from that same property for its components. The ﬁrst result is a special case of a more general result due to Middeldorp and Ohsaki [10, Theorem 6.7]. Theorem 4 ([10]). The disjoint union R of two TRSs is acyclic if both components are and either R is non-collapsing, or R is non-duplicating, or one of the components is both non-collapsing and non-duplicating. Here we complement the above result by showing that acyclicity is preserved when combining orthogonal acyclic TRSs. Theorem 5. Acyclicity is modular for orthogonal TRSs. Proof. See Appendix A. The proof method also yields modularity of absence of non-empty ﬁxed-point reductions of shape t C[t] for orthogonal TRSs. Remark 2. Both non-overlappingness and left-linearity are essential for acyclicity to be modular, answering questions by Middeldorp: Let Rb either be the overlapping left-linear TRS with rules {g(x, y) → x, g(x, y) → y} or the nonoverlapping non-left-linear TRS with rules {g(x, y, z, z) → x, g(x, y, z, S(z)) → y, ∞ → S(∞)}. In either case, Rb is acyclic since applying a g-rule decreases the number of g-symbols. Combining either with the acyclic orthogonal TRS Rw {f (0, 1, x) → f (x, x, x)} yields a cyclic combination Rb Rw , as can be seen from f (0, 1, g(0, 1)) or f (0, 1, g(0, 1, ∞, ∞)), respectively. Remark 3. First-orderness is also essential for modularity of acyclicity. The HRS (higher-order pattern rewriting system in the sense of Nipkow) consisting of the single rule f (xyz.Z(x, y, z), W, V ) → Z(W, Z(V, W, f (xyz.Z(x, y, z), W, V )), V ) is acyclic (see below). The two-rule TRS g(a, x, y) → x g(b, x, y) → y 1

Remarkably termination is decidable for S-terms [17].

102

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

is trivially acyclic. However, their combination is not as witnessed by f (xyz.g(x, y, z), a, b) → g(a, g(b, a, f (xyz.g(x, y, z), a, b)), b) → g(b, a, f (xyz.g(x, y, z), a, b)) → f (xyz.g(x, y, z), a, b) The main feat of the HRS is that the lhs of its rule is embeddable into its rhs, but only so in a non-empty context. If it were the case the context could be empty, then the term substituted for Z should collapse both to its second (y) and third (z) argument only depending on its ﬁrst (x) argument, which is impossible using only the ﬁrst rule (see Appendix B). It is exactly this feature which the two selection rules of the TRS bring. Remark 4. We conjecture that the corresponding CRS rule (combinatory reduction system in the sense of Klop): f ([xyz]Z(x, y, z), W, V ) → Z(W, Z(V, W, f ([xyz]Z(x, y, z), W, V )), V ) is acyclic as well. This does not follow directly from the above since the CRS contains ‘spurious’ terms, i.e. terms such as f ([x]f (x)) which are not the image of a HRS term. We conclude this section by discussing the relationship between normalization and acyclicity. Of course SN ⇒ AC, i.e. termination trivially implies acyclicity. More interesting is that in the presence of orthogonality weak normalization implies acyclicity. This result was preﬁgured in Kennaway [6] and recently rediscovered [7, Theorem 5.1], and extended [8, Theorem 3.1] by Ketema, Klop, and van Oostrom. Theorem 6. Assume a fully extended and weakly orthogonal HRS R. Then: R ∈ WN ⇒ R ∈ AC We give a sketch of the proof as it again nicely illustrates the minimal counter example technique, as well as the rˆ ole of normalization of the outermost-fair strategy. Proof. Assume that the system is not acyclic. Take a minimal term t with a cycle. That cycle contains a head step. As a consequence, t admits an inﬁnite reduction with inﬁnitely many head steps. Clearly such a reduction is outermostfair, and since the outermost-fair strategy is normalizing and the system is WN by assumption, the reduction ends in a normal form. Contradiction. Remark 5. Weak normalization cannot be relaxed from system to term level, as witnessed by the weakly normalizing but cyclic term f (a) in the orthogonal (but not WN) TRS {f (x) → b, a → a}.

Reduction Strategies and Acyclicity

5

103

Outermost-Fair Rewriting

Normalization of SF is proved by a reduction to normalization of outermostfair rewriting. This section is concerned with normalization of outermost-fair rewriting; it does not contain new results. A rewrite sequence is outermost-fair if every outermost redex is eventually contracted. For instance, in Example 5 the rewrite sequence h(g(a, c), c) → h(g(a, c), c) → . . . is not outermost-fair because it is unfair to the outermost redex a. The rewrite sequence j(h(h(x)), g(a)) → j(h(h(x)), g(a)) → . . . of Example 6 is not outermost-fair because it is unfair to the outermost redex h(h(x)). O’Donnell [12] shows that outermost-fair rewriting is normalizing for almost orthogonal TRSs. Van Oostrom [13] extends this in two directions: from ﬁrstorder to higher-order, and from almost orthogonal to weakly orthogonal. Theorem 7 ([13]). Outermost-fair strategies are normalizing for HRSs that are fully extended and weakly orthogonal. We collect some observations concerning the limitations of possible extensions. Remark 6. (i) In case rewrite rules with arbitrary overlapping patterns are allowed, then outermost-fair rewriting is not necessarily normalizing. Consider for instance the TRS from [13] deﬁned by {a → b, f (a) → f (a)}. The term f (a) can be reduced to the normal form f (b), but the outermost-fair reduction f (a) → f (a) → . . . does not reach a normal form. (ii) If non-fully-extended rewrite rules are allowed, then outermost-fair rewriting is not necessarily normalizing. Consider for example the HRS deﬁned by {f (λx. z) → a, g(x) → a, h(x) → h(x)}. The term f (λx. h(g(x))) has a normal form: f (λx. h(g(x))) → f (λx. h(a)) → a. However, the outermostfair reduction f (λx. h(g(x))) → f (λx. h(g(x))) → . . . contracting h-redexes does not reach the normal form. The reason is that the outermost f -redex is created only by contraction of the non-outermost g-redex. (iii) Outermost-fair does not imply coﬁnal. Consider for instance the TRS deﬁned by {f (x) → f (x), a → b}. The outermost-fair reduction f (a) → f (a) → f (a) → . . . is not coﬁnal because the term f (b) (which is a reduct of f (a)) cannot be reduced to a f (a). (iv) In [13] also head-normalization is considered. Using the proof method of Theorem 7, it is shown that outermost-fair strategies are head-normalizing for HRSs that are fully extended and almost orthogonal. Surprisingly, this cannot be extended to the weakly orthogonal case.

6

Church-Rosser Strategies

In a research seminar in 1975 with as outcome the set of notes [4], the question was raised whether there exists a computable one-step Church-Rosser strategy

104

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

for the λ-calculus? Here a strategy was deﬁned in the classical sense, so as a functional strategy, and the notion of a (functional) CR-strategy was deﬁned as in Deﬁnition 6. As far as we know, the question above is still unsolved. In [5] some partial results were obtained. Church-Rosser strategies are important for the following reason, stated in Barendregt [3, Lemma 13.1.4] (the assumption of conﬂuence is superﬂuous there; it follows from the assumption of a CR-strategy). Theorem 8 ([3]). Let F be a one-step or many-step functional strategy for the ARS A. Then: F is a CR-strategy

⇒

F is coﬁnal

⇒

F is normalizing.

Proof. The second implication is a special case of Proposition 1. We now prove the ﬁrst implication. So suppose F is a CR-strategy for A = (A, Φ, source, target) and let a ∈ A. We claim that the reduction a → F(a) → F2 (a) → . . . (in case F is a one-step strategy) or a → → F(a) → → F2 (a) → → . . . (in case F is a manystep strategy) is coﬁnal in G(a, A). Indeed, if b ∈ G(a, A), then a =A b, so since F ∈ CR, the trails F(a), F2 (a), F3 (a), . . . and F(b), F2 (b), F3 (b), . . . will intersect. This shows that F is a coﬁnal strategy. Theorem 9 ([5]). There exists a computable many-step CR-strategy for the lambda-calculus. One of the main problems in the proof of Theorem 9 is to avoid that the CRstrategy F to be deﬁned, falls in the trap of a double F-cycle which is linked, see Figure 6. Suppose there are two diﬀerent F-cycles C1 and C2 containing points M1 and M2 such that M1 =R M2 (that is, M1 and M2 are convertible in R). Then we are in a contradictory situation: F cannot be a CR-strategy, because the F-trails for M1 and M2 will keep cycling without ever intersecting. An eﬀective many-step CR strategy. We now show that under far more general circumstances a computable many-step CR-strategy exists.

Fig. 6. Linked cycles

Reduction Strategies and Acyclicity

105

Deﬁnition 9. An eﬀective ARS is an ARS A with an injective computable function # from objects to natural numbers, and where the reduction relation is computable. So if A is Church–Rosser, we can compute a common reduct for any given ﬁnite set of convertible objects. Eﬀective ARSs occur frequently, e.g. λ-calculus, or CL, or any TRS or HRS based on a ﬁnite signature and with a ﬁnite set of reduction rules. We will identify an object a with its corresponding natural number #a, and with →n the restriction of the reduction relation → of A to objects less than or equal to n is denoted. We show that if such an eﬀective ARS → has the Church–Rosser property, then it has an eﬀective many-step Church–Rosser strategy. The core of our strategy is constituted by the following procedure which, for a given equivalence class of terms less than a given bound n, attempts to ﬁnd a common reduct greater than that bound. Formally, for an object a and bound n with #a ≤ n the object an is deﬁned to be a common reduct of all (ﬁnitely many!) objects which are →n -convertible to a, such that that common reduct (i) is greater than n, or else (ii) is the greatest object of a strongly connected component of →n . Here ‘strongly connected’ means that every pair of objects is related by n . Note that by eﬀectiveness of the ARS and the Church–Rosser property it is easy to turn the construction of a reduct a common to the equivalence class, into a deterministic procedure. Next, by deterministically searching from a , going through the ﬁnitely many objects in the equivalence class, we will ﬁnd a unique common reduct greater than n if it exists. Otherwise, the second item applies and one notes that the strongly connected component, and hence the common reduct computed, is unique by the Church–Rosser property (the strongly connected component may consist of a single object; a normal form). The idea is then to repeat this procedure. But using what bounds? Using the number of the object itself as bound, i.e. from a compute a#a , may fail: 0

1

2

3

4

5

0

1

2

3

4

5

......

Fig. 7. Out-of-sync

Example 7. Consider the ARS of Figure 7, with the numbering # deﬁned by #i = 2i and #i = 2i + 1. Then 0#0 = 01 yields 2 (a common reduct of 0 and 0 and greater than both), 2#2 = 25 yields 4 , . . . whereas 1#1 yields 3 , 3 #3 yields 5 , etc.. A common reduct of 0 and 1 will never be reached. One could think of the problem as arising from each object determining its own ‘clock’ and these staying ‘out-of-sync’ forever. To avoid this phenomenon,

106

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

we inductively construct a (monotonically increasing) sequence of bounds n(i), which one can think of as the ‘ticks of a global clock’. – n(0) = 0; – n(i + 1) is the maximum of n(i) + 1 and all objects occurring in the construction of the common reducts an(i) , for a such that #a ≤ n(i). Now deﬁne CR(a) = an(i) , with i least such that #a ≤ n(i). Per construction a n(i+1) CR(a), and if the ﬁrst item applies n(i) < #CR(a) ≤ n(i + 1), or else CR(a) is the greatest object of a strongly connected component. Example 8. Consider the ARS of Figure 7 with the numbering # of Example 7. – – – – –

n(0) = 0, n(1) = 1, the number of 0 , a (common) reduct of 0 greater than 0, n(2) = 5, the number of 2 , a common reduct of 0 and 0 , n(3) = 9, the number of 4 , a common reduct of 0, . . . , 2 , n(4) = 13, . . .

Thus CR(0 ) = 01 = 2 and CR(2 ) = 25 = 4 which is the same object as CR(1 ) = 15 = 4 (since 2 and 1 are convertible within →5 ), as desired. Remark 7. ‘Ticks’ of the ‘global clock’ need not have ‘equal duration’. This can be seen by considering the multiplication ARS having positive natural numbers as objects (having themselves as number) and multiplication by a number as steps. Then n(i + 1) will be, for i ≥ 3, the least common multiple of all numbers up to n(i). Thus, in general, the ‘duration’ of the ‘ticks’ grows very fast. Theorem 10. CR is an eﬀective many-step Church–Rosser strategy. Proof. That CR is an eﬀective many-step strategy is clear from the above. To show it is a Church–Rosser strategy suppose a conversion between a and b exists, and let n(i) bound the largest object in this conversion. By the above, if the ﬁrst item always applies, then a n(i) CRk (a) and b n(i) CRk (b) for some k and k , and since a and b were assumed to be convertible within →n(i) , so are CRk (a) and CRk (b) and we conclude per construction of CR that CRk+1 (a) = CRk +1 (b). Otherwise, either sequence reaches the greatest object of some strongly connected component, which eventually will be reached by the other sequence of steps as well. Remark 8. The strategy CR only avoids cycles which do have ‘an exit’; a cycle without an exit (a strongly connected component) need not be avoided as it will be a common reduct (the unique sink of its connected component) due to the Church–Rosser property. As a corollary of Theorem 10 we also have a computable coﬁnal and normalizing many-step strategy for this class of systems. Kennaway’s theorem delivers a computable normalizing one-step strategy for the sub-class of almost orthogonal fully extended combinatory reduction systems (CRSs).

Reduction Strategies and Acyclicity

7

107

Coﬁnal Strategies

Using that CR-strategies are a fortiori coﬁnal, we have already some corollaries about the existence of coﬁnal strategies from the previous sections. What we do not have as a corollary is the following noteworthy theorem: Theorem 11 ([14]). There exists a computable coﬁnal one-step strategy for Combinatory Logic. Also for CL, the question whether there is a computable one-step CR-strategy seems to be open. In [15], Statman’s strategy is given and shown to be coﬁnal in the setting of orthogonal TRSs. As remarked there, an extension to the higher-order case is not immediate, because the proof of coﬁnality essentially uses the fact that residuals of parallel redexes remain parallel, which is not true for the higher-order case. An extension to the weakly orthogonal case seems possible.

8

Concluding Remarks

The reduction strategies studied here are memory-free, or history-free. It will be interesting to study strategies with some form of memory. An abstract initial approach to add memory is described in [15, p.480, Deﬁnition 9.1.6], there called ‘history-aware’.

References 1. Antoy, S., Middeldorp, A.: A sequential reduction strategy. Theoretical Computer Science 165(1), 75–95 (1996) 2. Baader, F., Nipkow, T.: Term Rewriting and All That. Cambridge University Press, Cambridge (1998) 3. Barendregt, H.P.: The Lambda Calculus, its Syntax and Semantic, of Studies in Logic and the Foundations of Mathematics. vol. 103, 2nd revised edn. NorthHolland, Amsterdam (1984) 4. Barendregt, H.P., Bergstra, J.A., Klop, J.W., Volken, H.: Degrees, reductions and representability in the lambda calculus. Technical Report 22, Utrecht University (February 1976) 5. Bergstra, J.A., Klop, J.W.: Church-Rosser strategies in the lambda calculus. Theoretical Computer Science 9(1), 27–38 (1979) 6. Kennaway, J.R.: Sequential evaluation strategies for parallel-or and related reduction systems. Annals of Pure and Applied Logic 43, 31–56 (1989) 7. Ketema, J., Klop, J.W., van Oostrom, V.: Vicious circles in orthogonal term rewriting systems. In: Antoy, S., Toyama, Y. (eds.) (WRS’04). Proceedings of the 4th International Workshop on Reduction Strategies in Rewriting and Programming. Electronic Notes in Theoretical Computer Science, vol. 124, pp. 65–77. Elsevier, North-Holland, Amsterdam (2005) 8. Ketema, J., Klop, J.W., van Oostrom, V.: Vicious circles in rewriting systems. In: DiCosmo, R., Toyama, Y. (eds.): WRS’05. Proceedings of the 5th International Workshop on Reduction Strategies in Rewriting and Programming (2005)

108

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

9. Klop, J.W.: Reduction cycles in Combinatory Logic. In: Hindley, J.R., Seldin, J.P. (eds.) To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism, pp. 193–214. Academic Press, San Diego (1980) Also available via http://web.mac.com/janwillemklop/iWeb/Site/Bibliography.html 10. Middeldorp, A., Ohsaki, H.: Type introduction for equational rewriting. Acta Informatica 36(12), 1007–1029 (2000) 11. Nipkow, T.: Higher-order critical pairs. In: Proceedings of the 6th annual IEEE Symposium on Logic in Computer Science (LICS ’91), pp. 342–349, Amsterdam, The Netherlands (July 1991) 12. O’Donnell, M.J.: Computing in Systems Described by Equations. LNCS, vol. 58. Springer, Heidelberg (1977) 13. van Oostrom, V.: Normalisation in weakly orthogonal rewriting. In: Narendran, P., Rusinowitch, M. (eds.) RTA 1999. LNCS, vol. 1631, pp. 60–74. Springer, Heidelberg (1999) 14. Statman, R.: Eﬀective reduction and conversion strategies for combinators. In: Comon, H. (ed.) RTA 1997, LNCS, vol. 1232, pp. 203–213. Springer, Heidelberg (1997) 15. Terese.: Term Rewriting Systems. In: Cambridge Tracts in Theoretical Computer Science, vol. 55, Cambridge University Press, Cambridge, UK (2003) 16. Toyama, Y.: Reduction strategies for left-linear term rewriting systems. In: Middeldorp, A., van Oostrom, V., van Raamsdonk, F., de Vrijer, R. (eds.) Processes, Terms and Cycles: Steps on the Road to Inﬁnity. LNCS, vol. 3838, pp. 198–223. Springer, Heidelberg (2005) 17. Waldmann, J.: The combinator S. Information and Computation 159, 2–21 (2000)

A

Proof of Modularity of Acyclicity

In this appendix we give a proof of Theorem 5 above. To that end, we ﬁrst establish a lemma on standard reductions which is interesting in its own right. Lemma 1 (Standard Preﬁx). In an orthogonal TRS, the collection of standard reductions ending in a head step, is totally ordered by the preﬁx relation. Proof. In this proof we freely make use of Huet and L´evy’s theory of standard/external reductions, for which we refer the reader to Sections 8.5 and 9.2.3 of [15]. First note that any standard reduction ending in a head step can be uniquely decomposed into a number of standard reductions such that only their ﬁnal step is a head step. Thus to prove the lemma, it suﬃces to show that for any term there is at most one reduction of the latter type. We claim that a standard reduction of which only the ﬁnal step is a head step is in fact an external reduction. The result then follows since supposing ρ and θ would be distinct such reductions from t, we may assume w.l.o.g. that they already diﬀer in their ﬁrst steps, say φ and ψ, and by totality of the textual order, we may assume w.l.o.g. that φ is to the left of ψ. Therefore, by externality of φ and standardness of θ, φ must have a unique residual up to the ﬁnal step of θ. But that ﬁnal step is a head step, so clearly it nests the residual of φ, contradicting externality of φ.

Reduction Strategies and Acyclicity

109

We prove the claim that any standard reduction of which only the ﬁnal step is a head step, is an external reduction by induction on the lengh of the reduction. If the length is 1, it is trivial. Otherwise, we may write the reduction as φ · ρ for some step φ. Since any suﬃx of a standard reduction is standard, the induction hypothesis yields that ρ is an external reduction. For a proof by contradiction, suppose that φ contracting a redex-pattern at position p were not external. That is, a reduction θ co-initial to ρ would exist, consisting of steps disjoint from p and ending in a term allowing a step ψ at position q nesting p. By standardness of φ · ρ, the position p is in the redexpattern of the ﬁrst step above p in ρ (if any). As ρ ends in a head step such a step indeed exists, say it is φ at position p above p, and let ρ be the preﬁx of ρ up to φ . Now consider the projections θ of θ over ρ , and ρ of ρ over θ. Since by construction neither θ nor ρ contracts redex-patterns on the path from the root to p, neither do their projections, hence the common reduct contains unique residuals of both ψ after ρ and of φ after θ, respectively at positions q and p above p. Since the positions above p are totally ordered by the preﬁx relation, either of q and p is above the other. We prove that neither is possible. If q is properly above p , then the reduction θ disjoint from p and ending in a term containing a redex-pattern nesting p , shows that φ is not external, contradicting the induction hypothesis. If p is above q, then since q is above p and the redex-pattern at p overlaps p, the redex-patterns of φ and ψ must have overlap in the common reduct of θ and ρ , contradicting orthogonality. Remark 9. Although the lemma and its proof go through for higher-order rewriting systems, we have refrained from stating these since the next theorem doesn’t generalise to the higher-order case (the result fails as shown in this paper, and its proof fails in it being based on the notion of rank). Theorem 12. Acyclicity is modular for orthogonal TRSs. Proof. In this proof we freely make use of the notions of modularity and tracing, for which we refer the reader to Sections 5.7.1 and 8.6.1 of [15]. Let Rb Rw be the disjoint union of the orthogonal TRSs Rb and Rw . To prove that acyclicity is a modular property is to prove that the underlying rewrite system →Rb Rw , which we will abbreviate to →, is acyclic if both →Rb and →Rw are. For a proof by contradiction, assume that →Rb Rw would allow a non-empty cycle σ on some term t, which we may w.l.o.g. assume to be of minimal rank. Since the rewrite systems →Rb and →Rw are acyclic by assumption, the rank of t must be positive, say it is n + 1. By minimality, at least a single step in σ must contract a redex-pattern in the top layer. Finally, w.l.o.g. we may assume t to have a minimal number, say m + 1, of principal subterms of maximal rank, i.e. of rank n. Since rewriting does not increase the rank, the fact that σ is a cycle entails that the rank of all the terms along σ must be n + 1, so none of them has a principal subterm of rank greater than n. Now, let p be the vector of positions of principal subterms of maximal rank in t. We claim that for some index i

110

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

and some positive k, pi is its own origin when tracing pi back along the k-fold repetition σ k of σ. The claim holds true by the Pigeon Hole Principle and the fact that a principal subterm of maximal rank has another such subterm as origin.2 Let s be the principal subterm of maximal rank at the position pi given by the claim. We show that from t we can obtain a term t which also allows a non-empty cycle but has at most m principal subterms of rank n, yielding a contradiction. The term t is obtained from t by replacing a number of principal subterms, the subterm s at position pi inclusive, by a term s the rank of which is less than that of s. The replacement term s is deﬁned as follows. If s allows some reduction having a destructive step in its top layer, then as standardisation preserves this and a destructive step in the top layer is a head step, the Standard Preﬁx Lemma yields some standard reduction ρ from s ending in a destructive step, which is least among such in the preﬁx order, and we let s be the target of ρ. Otherwise, we let s be a fresh variable. Either way, the rank of s is less than the rank of s. To see which principal subterms, other than s at position pi , of t are to be replaced by s , we proceed as follows. Consider tracing pi forward along an inﬁnite repetition of σ k , where we only let a position trace as long as it is the position of a principal subterm.3 Then we let p be the collection of all descendants which occur in t after some repetititon of σ k , and let t be obtained from t by replacing all subterms at positions in p by s . Note that by the above, pi itself is among the p , and that by construction the subterms of t at positions in p are reachable from s. Next, we show the non-empty cycle σ k on t can be simulated by a non-empty cycle σ on t , by simulating each step φ : u → v by a reduction φ : u v depending on the relative positions of the redex-pattern contracted in φ and the (pairwise disjoint) descendants of p in u. The invariant is that u is obtained from u by replacing all subterms at positions of descendants of p by s . – If φ contracts a redex-pattern outside, i.e. in the context of, the descendants of p in u, then we let φ : u → v be obtained by contracting the same redex-pattern in u . – If φ contracts a redex-pattern inside some descendant of p and φ is not destructive at its top layer, then we let φ : u u be the empty reduction. – If φ is a destructive step at a descendant p of p , then the subterm v|p is reachable from s as noted above, hence per construction of s and the Standard Preﬁx Lemma, there also exists some reduction from s to v|p via s , thus using u = u [s ]p we may set φ : u [s ]p u [v|p ]p . That σ is non-empty follows from the fact that σ contains at least one step in its top layer, which will be simulated by exactly one step in σ according to the ﬁrst item of the simulation. To show that σ is a cycle, it suﬃces to show that 2

3

Note that the claim need not hold when ﬁxing k to 1. For instance, σ might swap two principal subterms (setting k to 2 then works). Per construction positions trace statically; a redex-pattern overlapping one would be polychrome quod non.

Reduction Strategies and Acyclicity

111

each position p among p in t traces back along σ k to some position in that set again, which is trivial per construction of the set.

B

Proof of Acyclicity of a PRS

Lemma 2. The PRS consisting of the following rule is acyclic: f (xyz.Z(x, y, z), W, V ) → Z(W, Z(V, W, f (xyz.Z(x, y, z), W, V )), V ) Proof. By contradiction. To that end, suppose a non-empty cycle σ on t were to exist. W.l.o.g. we may assume such a t to be of minimal size among all terms admitting a non-empty cycle. Moreover, we may assume by the Standardisation Theorem for left-linear PRSs, that σ is standard. We will employ the notion of gripping path due to Melli`es. Say a position of an f -symbol in a term grips any position of an f -symbol which has a variable bound by the binders of the former, below it. Note that a position only can grip positions inside its ﬁrst argument, as only that argument has (three) binders. For instance, if we were to have a term f 1 (xyz.f 2 (x y z .a, f 3 (x y z .a, x, a), a, a), a, f 4 (x y z .a, a, a)), where we have labelled the f -symbols for easy reference, then f 1 grips both f 2 and f 3 as both contain the variable x bound by f 1 . Note that f 2 does not grip f 3 . Then a gripping path is a path w.r.t.. the gripping relation; in the example term there are just two non-trivial paths f 1 f 2 and f 1 f 3 . Note that gripping paths are ﬁnite since successive positions are properly ordered by preﬁx. The property to be exploited is that gripping paths are preserved under taking their (position-wise) origin along any rewrite step, where we take as origin/descendant relation the usual (static) one [15], except that as origin of (all copies of) the f displayed in the right-hand side the head-f of the left-hand side is taken. The point is that if the path in the target of a step has some position below the contracted redex—which is the only interesting case—then the ﬁrst such must either be the position of the head-symbol of the copy of the redex, or be in one of the copies of (the terms substituted for) the meta-variables in the rhs. In either case, the path must proceed completely inside that copy, by the variable convention. But then a corresponding path exists in the source of the step through the corresponding copy. Now consider the origin of an arbitrary gripping path from the root of t along σ. This origin is again a gripping path in t by the above and by σ being a cycle. Distinguish cases depending on whether its ﬁrst position, say p, is on some gripping path from the root of t or not. If it is not, then consider the position q which is closest to the root and above p such that it is not on some gripping path from the root. Per construction, the subterm headed by q, say t , contains no variable bound by an f -symbol above it. Since p descends, also per construction, to the root of t along σ which was assumed to be standard, it follows that t reduces to t somewhere along σ. Thus there would be a cylce on t as well, contradicting minimality of t. If it is, then a further case distinction is made depending on whether p is itself the root or it isn’t.

112

J.W. Klop, V. van Oostrom, and F. van Raamsdonk

If p is not the root, a contradiction is obtained since then for any gripping path from the root in t, one obtains a longer such path by preﬁxing its origin along σ by the (non-empty) gripping path from the root to p. If p is the root, then ﬁrst note that by the minimality assumption for t, σ must contain some head step. By standardness and the shape of the lhs—which is a pattern which cannot be created—also the ﬁrst step of σ must be a head step, i.e. σ : f ([xyz]t , s, u) → t [x, y, z := s, t [x, y, z := u, s, t], u] f ([xyz]t , s, u) and the root descends to the head f -symbol of a fresh copy of t in the rhs. Both y and z must occur in t otherwise t would be erased. Therefore. by reasoning as above, the (instantiated) copies of t above the f -symbol must be collapsable to their second respectively third arguments, depending on the respective substitutions s and u for its ﬁrst argument. However, neither s nor u contains a variable bound outside it, and thus a collapsing reduction from t could not depend on them. Contradiction.

Towards Rewriting in Coq Jacek Chrząszcz and Daria Walukiewicz-Chrząszcz Institute of Informatics, Warsaw University ul. Banacha 2, 02-097 Warsaw, Poland {chrzaszcz,daria}@mimuw.edu.pl

This work is dedicated to Jean-Pierre Jouannaud who is unquestionably a spiritus movens of the research on bringing rewriting to Coq. Abstract. Equational reasoning in Coq is not straightforward. For a few years now there has been an ongoing research process towards adding rewriting to Coq. However, there are many research problems on this way. In this paper we give a coherent view of rewriting in Coq, we describe what is already done and what remains to be done. We discuss such issues as strong normalization, conﬂuence, logical consistency, completeness, modularity and extraction.

1

Introduction

Large part of research in modern theoretical computer science is concerned with formalizing mathematical reasoning. On one hand various formal calculi are being developed which model mathematical notions and proofs. On the other hand computer programs are written which implement these formalisms together with tools which help the users formalize and solve their mathematical problems. In this paper we concentrate on Coq [17], a proof assistant based on type theory and the Curry-Howard correspondence, which relates formulas to types and their proofs to terms of these types. Calculus of constructions. The ﬁrst version of Coq (which was called CoC at that time) was designed in the late 80s by Coquand and Huet. It implemented the calculus of constructions, i.e. the lambda calculus, equipped with a powerful typing discipline containing polymorphism, dependent types and type constructors. Let us mention one typing rule, conversion, which will be important to us in the rest of the paper. E a : t E t : s E a : t

if t ≈ t

This rule says that a proof of t is also a proof of any correct formula t which is convertible to t. In the pure calculus of constructions, the convertibility relation

This work was partly supported by the Polish government grant 3 T11C 002 27 and the EU FP6 project IST-15905 Mobius.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 113–131, 2007. c Springer-Verlag Berlin Heidelberg 2007

114

J. Chrząszcz and D. Walukiewicz-Chrząszcz

≈ is only β-equality, which due to normalization and conﬂuence of β-reduction can be checked automatically. The latter property is also crucial for the decidability of type-checking. In the calculus of constructions it is possible to deﬁne natural numbers, lists, booleans and other inductive types by using the so-called impredicative encoding. For example, natural numbers can be represented as polymorphic Church numerals with their type N at ≡ ∀C : , C → (C → C) → C. Nevertheless this coding has some important drawbacks concerning both logical and computational aspects. It is for example impossible to prove that 0 is diﬀerent from 1, induction principles, for example on natural numbers, are not provable, and some trivial functions, like predecessor on natural numbers, cannot be computed in constant time. Calculus of inductive constructions. In early 90s Coquand and Paulin proposed to extend the calculus with new kinds of syntactic objects: inductive deﬁnitions introducing a type and its constructors and elimination schemes for that type [19]. The elimination schemes come together with their reduction rules called ι-reduction, which extends convertibility. The real novelty in the calculus of inductive constructions is strong elimination, which allows one to build types by recursion over inductive types. Using strong elimination one can show that 0 is diﬀerent from 1. Other problems of impredicative encoding of inductive types are now also solved. The calculus of inductive constructions preserves all essential meta-theoretical properties of the original system: it is terminating, conﬂuent, logically consistent and has decidable type-checking [46]. Unfortunately using recursors to write function deﬁnitions is not very easy and the deﬁnitions, once written, are not very readable. A solution to these problems is to replace the elimination schemes by two separate mechanisms: one for pattern-matching (or case-analysis), and one for constructing well-founded recursive functions. Deﬁnitions by pattern-matching were added to Martin-Löf’s type theory by Coquand [18]. Consequently, constants may be deﬁned not only explicitly, by giving a term, but also implicitly by a set of deﬁning equations of the form f (u1 , . . . un ) = e, which must be exhaustive and unambiguous. An adaptation of the above idea to the context of the calculus of constructions is due to Christine Paulin and was implemented in Coq in 1994. The problem of checking unambiguity and exhaustiveness is eliminated by choosing a simple format of case analysis using the match operator. The simple format was later extended to more complex patterns in [20]. The recursive deﬁnitions are built using the ﬁxpoint operator fix. Normalization is guaranteed within the type-checking rule of fix. Every recursive call must operate on arguments that are structurally smaller than the original ones, i.e. are deconstructed from the original arguments by a match. Although quite natural and general enough to encode many interesting functions, the fix rule with its guard condition causes problems, both at the practical and the theoretical levels: complicated meta-theory, non-incremental

Towards Rewriting in Coq

115

proof-checking, etc. For these reasons several versions of type annotations were proposed to hide the guardedness condition in the type system [25,36,26,9,5]. There is a running prototype implemented for the system [5]. In order to simplify writing deﬁnitions of functions, several authors consider direct translation of functional programs to Coq [35,39]. Another possibility is to include in Coq the style of pattern-matching deﬁnitions as proposed by Coquand. But pattern-matching equations are just a restricted form of rewrite rules. Rewriting in the calculus of constructions. There is an ongoing research process aiming at adding rewriting into theorem provers based on type theory and CurryHoward Isomorphism such as Coq. Jean-Pierre Jouannaud, who was supervisor of our PhD theses [15,42], is one of the people who actively pushed this research on. Deﬁning functions by rewriting is as simple and elegant as the deﬁnitions by pattern matching, but the user has a possibility to add more rules, that would otherwise have to be proved as axioms or lemmas in the form of Leibniz equalities or heterogeneous equalities. Moreover, rules can be ambiguous (their left-hand sides may overlap) as long as the rewriting system is conﬂuent. By transforming equalities into rewrite rules, one makes the conversion richer and therefore proofs shorter and more automatic. Moreover more terms are now typable, so the calculus becomes more expressive. As long as conversion is decidable, extending the conversion can be seen as a means to separate reasoning from computing in a similar manner that is used in Deduction Modulo [23]: while the proof term must record all deduction steps, the computation steps can be hidden away in conversion and performed automatically. This could be most helpful when working with axiomatic equational theories, like e.g. group theory, that can be transformed into conﬂuent and terminating rewriting systems. There exist tools that assist users in performing such transformations (see e.g. [16]). In order to maintain conversion and hence type-checking decidable one must be careful to add only rewrite rules which would not spoil subject reduction, strong normalization and conﬂuence. The easiest and the most natural way to preserve subject-reduction is to require that the left- and right-hand sides of a rule have the same type. More ﬂexible approaches allow for the left- and righthand sides that do not need to be well-typed (see discussion about underscore variables in the next section). Since it is not possible to check automatically whether a given set of rewrite rules in strongly normalizing, one has to come up with decidable criteria ensuring strong normalization and ﬂexible enough to accept most of the known and useful deﬁnitions by rewriting. In [1] it is shown that the calculus of constructions can be safely extended with any terminating and conﬂuent ﬁrst-order rewriting system. For the higher-order case, there are two such criteria: HORPO [42] by the second author and the General Schema [6] by Frédéric Blanqui. They are both discussed in detail in Section 3. In the paper of Blanqui, the second problem, conﬂuence, is also discussed. But ensuring termination and conﬂuence is of course not enough. To trust theorems proved with the help of a proof assistant based on a formalism one

116

J. Chrząszcz and D. Walukiewicz-Chrząszcz

needs logical consistency. Without rewriting, consistency is guaranteed for all developments without axioms. With rewriting, one can show it for all developments where rewriting systems are complete [10,45]. Practical way of checking completeness is also provided in [45] and discussed in Section 5. In this paper we give a general vision of rewriting in Coq, how we think it will look and feel. We particularly care to maintain the important characteristics of Coq, such as decidable conversion and type-checking, interactive proof development, canonicity of inductive types, logical consistency etc. At the same time we aim to be able to express by rewriting the elimination schemes for inductive types and deﬁnitions by case-analysis and therefore to drop ι-reduction from the system.

2

Rewriting — Look and Feel

Let us imagine a future version of Coq with rewriting, where deﬁnitions by rewriting will be entered just as all other deﬁnitions:1 Welcome to Coq 10.1 Coq < Symbol + : nat Rules | O + y −→ y | x + O −→ x | (S x) + y −→ S (x | x + (S y) −→ S (x | x + (y + z) −→ (x

→ nat → nat

+ y) + y) + y) + z.

The above fragment deﬁnes addition on unary natural numbers. This function is deﬁned by induction on both arguments simultaneously and the last rule expresses associativity. Introducing a new deﬁnition by rewriting to an environment can be done just like for inductive deﬁnitions. E ok

E Rew(Γ ; R) : correct E; Rew(Γ ; R) ok

(1)

If the environment E is correct and if the new deﬁnition by rewriting is correct, then we can add it to the environment. The right premise stands for all tests that have to be performed before environment extension. First, the deﬁnition must be well-formed, e.g. the local environment Γ must contain function symbols only, their types must be correct etc. Second, the rewriting system must verify the chosen acceptance condition, which should guarantee subject reduction, strong normalization and conﬂuence of the system after adding the given deﬁnition by rewriting. Note that at this point we only require properties that are needed to keep type-checking decidable. The user is free to add a rewriting system which causes 1

The syntax of the deﬁnition by rewriting is inspired by the experimental “recriture” branch of Coq developed by Frédéric Blanqui.

Towards Rewriting in Coq

117

inconsistency, just as he is free to add an inconsistent axiom but not a nonterminating ﬁxpoint deﬁnition in the current version of Coq. Consistency of environments containing deﬁnitions by rewriting is a separate issue which is discussed in Section 5. Rewrite rules are to be used in the conversion rule, and since the set of available rules depends on the environment, so does the conversion relation. The correct version of conversion rule is: E t ≈ t Ea:t E t : s E a : t Going back to our example, the deﬁnition of + is well-typed, conﬂuent and terminating, so we can assume that it is correct and safely add it to the environment. Our deﬁnition is also complete in the sense that for all pairs of canonical natural numbers (i.e. made of constructors), their sum computes into a canonical natural number. With this deﬁnition, + becomes much more useful than the one usually deﬁned using match and fix. Both lemmas ∀x : nat. 0 + x = x and ∀x : nat. x + 0 = x can be proved by λx : nat. reﬂ nat x, where reﬂ is the only constructor of the Leibniz equality inductive predicate. Since the deﬁnition of addition is now symmetric we do not have to use induction for any of the two lemmas. By enriching conversion, we also make more terms typable. Hence the logical language becomes more expressive, especially when dependently typed programs and their properties are considered. The most prominent example of this kind is the append function on lists with length. For the sake of simplicity, let us assume that we have a list of boolean values. Inductive nlist : nat → Set := | nnil : nlist O | ncons : bool → forall n:nat, nlist n → nlist (S n). Symbol append : forall n m:nat, nlist n → nlist m → nlist (n+m). Rules | append O m nnil lm −→ lm | append (S n) m (ncons b1 n ln) lm −→ ncons b1 (n+m) (append n m ln lm) | append n O ln nnil −→ ln.

Note that without the symmetric + in the conversion, either the ﬁrst two rules or the last rule would not be well-typed. Indeed, in the ﬁrst rule, the type of the left hand side is nlist (0+m) and the type of the right hand side is nlist m and in the third rule the corresponding types are respectively nlist (n+0) and nlist n. Thanks to the fact that associativity of + is in conversion, one could write and prove the following equational property of append. append k (n+m) lk (append n m ln lm)=append (k+n) m (append k n lk ln) lm

The types of both sides are listn ((n+m)+k) and listn (n+(m+k)) respectively, and since standard Leibniz equality requires terms to compare to have convertible types, associativity of + must be in conversion.

118

J. Chrząszcz and D. Walukiewicz-Chrząszcz

Rewrite rules can also be used to deﬁne higher-order and polymorphic functions, like the map function on polymorphic lists. Inductive list (A : Set) : Set := nil : list A | cons : A → list A → list A. Symbol map : forall A B:Set, (A → B) → list A → list B Rules map A B f (nil A) −→ nil B map A B f (cons A a l) −→ cons B (f a) (map A B f l).

Even though we consider higher-order rewriting, we think that it is enough to choose the simple matching modulo α-conversion. Higher-order matching is useful for example to encode logical languages by higher-order abstract syntax, but it is not really used in Coq where modeling relies rather on inductive types. Instead of higher-order matching, one rather needs the possibility to underspecify some arguments. Consider for example transforming the equation for associativity of append into a rewrite rule: append k (n+m) lk (append n m ln lm) −→ append (k+n) m (append k n lk ln) lm

The (n+m) argument of append is needed there just for the sake of correct typechecking of the left-hand side, because the type of append n m ln lm is list (n+m). It has no meaning for actual matching of this rewrite rule against terms, because in all well-typed terms, the second argument of append is the length of the fourth argument anyway. Besides, putting (n+m) in the rewrite rule creates many critical pairs with +, which cannot be resolved without adding many new rules (either by hand or through an automatic completion procedure) to make the rewriting system conﬂuent. Instead, we could replace (n+m) by a fresh variable (or by an underscore standing for a “don’t care” variable) and write this rule as: append k _ lk (append n m ln lm) −→ append (k+n) m (append k n lk ln) lm

This new rule matches all well-typed terms matched by the old rule, and more. Moreover, there is no critical pairs between this rule and the rules for + and the rule becomes left-linear, which is both easier to match and may help with conﬂuence proof. The downside is that the left-hand side of the rule is not welltyped anymore which might make the proof of subject reduction harder. This way of writing left-hand sides of rules was already used by Werner in [46] to deﬁne elimination rules for inductive types, making them orthogonal (the (c x), where P , f, w, x are distinct left-hand sides are of the form Ielim P f w variables and c is a constructor of I). In [10], Blanqui gives a precise account of these omissions using them to make more rewriting rules left-linear. Later, the authors of [13] show that these redundant subterms can be completely removed from terms (in a calculus without rewriting however). In [4], a new optimized

Towards Rewriting in Coq

119

convertibility test algorithm is presented for Coq, which ignores testing equality of these redundant arguments. It is also interesting to note that when the second argument of append is a fresh variable then we may say that this argument is matched modulo conversion and not syntactically.

3

Strong Normalization

In this section we concentrate on the part of acceptance criterion for rewrite rules which is supposed to guarantee strong normalization. The ﬁrst article about higher-order rewriting in the calculus of constructions is [2,3], where the authors extend the termination criterion called the General Schema, originally deﬁned in [28]. This result is further extended in [11] by adding a powerful mechanism, called the computable closure and further on in [6,10,8,7,9] where rewriting on types, rewriting modulo AC, extended recursors and type-based termination are considered. Another method for proving strong normalization of higher-order rewriting is the Higher Order Recursive Path Ordering (HORPO). HORPO was originally presented in [29], in the context of the simply typed lambda calculus. A version of HORPO for the calculus of constructions was ﬁrst presented in [41] and its journal version [43]. An extended and elaborated version of the results can be found in [42]. The works on HORPO and the General Schema share the approach to rewriting in the calculus of constructions presented in the previous section. Rewriting is introduced by rewrite rules on function symbols that are constants added to the system. Function symbols can have dependent and polymorphic types. In [42] (HORPO approach) both sides of every rewrite rules must have the same type, in [6] (General Schema) they are meant to have the same type for any typable instance of the left-hand side. In order to have strong normalization, the form of the rules is further restricted: it is required that all meaningful type parameters of the head function symbol of left-hand sides must be diﬀerent variables. Both termination criteria, the General Schema and HORPO, are based on a well-founded ordering on function symbols, called precedence. Inductive types are built from type constructors and constructors satisfying some positivity conditions, and elimination schemes are just function symbols with associated rewrite rules. It is shown that most elimination schemes can be accepted by the General Schema and HORPO. In order to deal with elimination schemes, the structural ordering associated with inductive deﬁnitions is incorporated in both HORPO and General Schema. They share also the use of computable closure (ﬁrst used in the context of the simply-typed λ-calculus [12]), which is a set of terms derived from the left-hand side by some syntactic reducibility-preserving operations. While the General Schema consists essentially of the computable closure, its use in HORPO is just one of the possibilities. Nevertheless, it is not the case that

120

J. Chrząszcz and D. Walukiewicz-Chrząszcz

all object level rules accepted by the General Schema are accepted by HORPO. Apart from some technical conditions, the reason is mainly hidden in the different approaches to inductive types and constructors; in [6], where the General Schema is used, every function symbol whose output type is an instance of an inductive type I is considered as a constructor of I, in [42], where HORPO is used, the standard vision of constructors as symbols that do not rewrite is adopted. In both works, strong normalization is shown using the method of reducibility candidates. In [42] the proof is done not for a particular rewrite system accepted by HORPO, but for the whole HORPO itself. In other words, the calculus of constructions is extended with the rewrite relation generated by all valid HORPO judgments and it is shown that the resulting calculus is strongly normalizing. This implies strong normalization of any set of rewrite rules accepted by HORPO. In [6] the proof is done for any set of rules accepted by the General Schema. An important characteristic of the General Schema is the possibility to deﬁne rewriting rules at the level of types and not only at the level of objects. This kind of rewriting enables to write, for example large elimination rules for inductive types. To deal with type-level rewriting, conﬂuence is needed. For that reason, all rules in [6] have to be left-linear (see Section 4). Extension to type-level rewriting for HORPO cannot be shown this way, since HORPO is obviously non conﬂuent. Practical issues. In order to be suitable for implementation, the termination criteria must have two important properties: decidability and compatibility with further extensions of environments. Both, HORPO and General Schema, are decidable criteria for accepting rewrite rules. Putting aside the convertibility tests, checking a rewrite rule has a polynomial complexity. Environment extension corresponds to rule 1 in Section 2 and accounts for building one rewriting system on the top of another. Originally proofs of strong normalizations for both criteria were done for the static setting: signature, precedence on function symbols, and set of rewrite rules were given in advance. But this can be adapted to the situation where a new set of rewrite rules is deﬁned for symbols from the new signature, and type-checked with the calculus of construction extended with rewriting coming from all previous rewrite systems. Examples. Let us end this section with some examples explaining the condition about diﬀerent variables as type parameters of head function symbols of the left-hand sides and illustrating what more can be done concerning strong normalization. The following identity rule for polymorphic map: forall A B:Set, (A → B) → list A → list B can be accepted neither by HORPO nor by the General Schema: map C C λx.x l

−→ l

Towards Rewriting in Coq

121

In the General Schema approach rules have to be left-algebraic (cannot contain abstractions) and this one is not. In HORPO, the condition on type parameters is not satisﬁed, as map has the same variable as the ﬁrst and the second argument. Nevertheless, it is believed that it cannot break strong normalization. The following rule for the function symbol J is not accepted either: Symbol J : forall A B:Set, A → B → A Rules J C C a b −→ b

But this time it can be shown that this innocent-looking rule leads to nontermination. This example derives from the one presented by J.-Y. Girard in [27] and was shown to authors by Christine Paulin (see Chapter 6 in [42] for details concerning nontermination). An evident diﬀerence between the two rules presented above is that there a b the type of which is diﬀerent from exists a well-typed instance of J C the type of the corresponding instance of b and that it is not possible for map. λx.x l −→ Nevertheless HORPO from [42] cannot deal with the rule map C l either since it requires both sides of the rules to have the same type. On the other hand the identity rule for monomorphic mmap : forall A:Set, (A → A) → list A → list A: mmap C λx.x l

−→ l

satisﬁes the condition about diﬀerent type variables. It is accepted by HORPO and rejected by the General Schema, because it is not left-algebraic. The next example concerns the heterogeneous equality JMeq. Inductive JMeq (A:Set)(a:A) : forall B:Set, B → Set := JMeq refl : JMeq A a A a.

The standard elimination scheme for this rule (JMeq std) does not satisfy the condition about diﬀerent type parameters and hence is rejected by HORPO. But it is known to be terminating already from the works on CIC (see [46] and also [7]). Symbol JMeq_std : forall (A:Set)(a:A)(P:(B:Set)B → Set), P A a → forall (B:Set)(b:B), JMeq A a B b → P B b Rules JMeq_std A a P h A a (JMeq refl A a) −→ h

However, its nonstandard (and more useful) elimination scheme JMeq nstd satisﬁes the condition on type parameters and can be shown terminating by both HORPO and the General Schema. Symbol JMeq_nstd : forall (A:Set)(a:A)(P:A → Set), P a → forall (b:A), JMeq A a A b → P b Rules JMeq_nstd A a P h a (JMeq refl A a) −→ h

122

4

J. Chrząszcz and D. Walukiewicz-Chrząszcz

Confluence

Conﬂuence of the calculus of constructions with rewriting is less studied than strong normalization and it is known for two kinds of situations. First, if strong normalization can be established without conﬂuence (it is the case for the objectlevel rewriting, see [6,42]), then conﬂuence is a consequence of the strong normalization and local conﬂuence, i.e. joinability of critical pairs. If conﬂuence is needed before the strong normalization proof then the result of [33] can be used. It states that the sum of beta reduction with conﬂuent left-linear and leftalgebraic rewrite system R is conﬂuent. Conﬂuence of R (without beta reduction) is usually simpler to achieve; in [6] it is shown for every R being a combination of a ﬁrst-order system that is strongly normalizing and nonduplicating with a set of ﬁrst- and higher-order rules satisfying the General Schema and such that critical pairs of R are joinable. Left-linearity may seem an important restriction when using dependent types, but it is not really the case. In fact, nonlinearities due to typing can be avoided using underscore variables, like described in Section 2. Nevertheless, if one aims to deal with type-level rewriting, both type- and object-level rules have to be left-linear and left-algebraic. In order to lift this restriction one should probably consider a simultaneous proof of strong normalization and conﬂuence.

5

Logical Consistency, Completeness of Definitions and Inductive Consequences

Adding arbitrary rewrite rules to the calculus of constructions may easily lead to logical inconsistency, just like adding arbitrary axioms. It is of course possible to put the responsibility on the user, but it is contrary to the current Coq policy to guarantee consistency of a large class of developments, namely those which do not contain axioms. Since we plan on using rewriting as a principal means of deﬁning functions, we have to come up with a large decidable class of rewriting systems that are guaranteed not to violate consistency. Logical consistency for the calculus of constructions with rewriting was ﬁrst studied in [10]. It was shown under an assumption that for every symbol f deﬁned by rewriting, f (t1 , . . . , tn ) is reducible if t1 . . . tn are terms in normal form in the environment consisting of one type variable. But there were no details how to satisfy the assumption of the consistency lemma. In [45] it is shown that logical consistency is an easy consequence of canonicity, which can be proved from completeness of deﬁnitions by rewriting (discussed below), provided that termination and conﬂuence are proved ﬁrst. More precisely, it can be shown that in every environment consisting only of inductive deﬁnitions and complete deﬁnitions by rewriting, every term of an inductive type can be reduced to a canonical form. This, by an easy analysis of normal forms, implies that there is no proof of Πx : ∗.x. Completeness of definitions by rewriting. Informally, a deﬁnition by rewriting of a function symbol f is complete if the goal f (x1 , . . . , xn ) is covered, which

Towards Rewriting in Coq

123

means that all its canonical instances are head-reducible. In [45] the deﬁnition of completeness is precised in such a way that it guarantees logical consistency and there exist a sound and terminating algorithm for checking completeness of deﬁnitions. If we adopt the view that properties of a rewriting system should be checked when it is being introduced to an environment (see typing rule 1 in Section 2), then completeness of the function symbol f has to be checked much earlier than it is used: one uses it in an environment E = E1 ; Rew(f, R); E2 but it has to be checked when f is added to the environment, i.e. in the environment E1 . It follows that completeness checking has to account for environment extension and can be performed only with respect to arguments of such types which guarantee that their set of normal inhabitants would not change in the future. This is the case for inductive types whose normal inhabitants are always terms built from constructors. In [45] there is also an algorithm for checking completeness. It checks that a goal is covered using successive splitting, i.e. replacement of variables of inductive types by constructor patterns. In presence of dependent types not all constructors can be put in every place. The head function below is completely deﬁned since nnil can never be of type nlist (S n). Symbol head : forall (n:nat) nlist (S n) → bool Rules head n (ncons b n l) −→ b

The algorithm is necessarily incomplete, since in the presence of dependent types emptiness of types trivially reduces to completeness and the former is undecidable. The algorithm accepts all deﬁnitions that follow dependent pattern matching schemes presented by Coquand and studied by McBride in his PhD thesis. Extended with the second run, it deals with all usual deﬁnitions by case analysis in Coq. It also accepts many deﬁnitions by rewriting containing rules which depart from standard pattern matching. The rewriting systems for +, append, map, JMeq std, JMeq nstd presented earlier can be easily proved complete by the algorithm. This is also true for Streicher’s axiom K: Symbol K : forall (A:Set) (a:A) (P:eq A a a → Set), P (refl A a) → forall p: eq A a a, P p Rules K A a P h (refl A a) −→ h

Another method for checking completeness of pattern matching equations in the Calculus of Constructions is presented in [34]. It consists in computing approximations of inductive types and is not based on splitting; for that reason it accepts some of the examples not accepted by the algorithm described above. Fortunately, it seems that the approximation method can be easily added to the algorithm from [45] as another phase, if the original version fails to show completeness.

124

J. Chrząszcz and D. Walukiewicz-Chrząszcz

Inductive consequences. During the completeness check of a deﬁnition by rewriting only some of the rules are used; usually they correspond to the pattern matching deﬁnition of a given symbol. An interesting question is how much the rules outside this part extend the conversion. For ﬁrst-order rewriting it is known that these rules are inductive consequences of the pattern matching ones, i.e. all their canonical instances are satisﬁed as equalities (see e.g. Theorem 7.6.5 in [40]). It is also true for higher-order and dependent rewriting in the calculus of constructions as long as there is no rewriting under a binder in the rewrite steps needed to join the critical pairs [44]. For example, the identity rule for the monomorphic mmap function from Section 3 is clearly an inductive consequence of the basic rules for nil and cons. Unfortunately, the problem is more diﬃcult for higher-order rules over inductive types with functional arguments. The deﬁned function symbol might get under a binder and might be applied to a bound variable instead of a canonical term on which it is always reducible. Here is an example: Inductive ord : Set := o : ord | s : ord → ord | lim : (nat → ord) → ord. Rewriting n2o : nat → ord Rules n2o O −→ o n2o (S x) −→ S (n2o x) Rewriting id : ord → ord Rules id o −→ o id (s x) −→ s (id x) id (lim f) −→ lim (fun n => id (f n)) id (id x) −→ id x

The last rewriting system is conﬂuent (unlike the one in which the last rule is replaced with id x −→ x because the critical pair for x=(lim f) needs eta to be joinable). Now, for l = id (id x), r =id x, σ = {x → lim (fun n ⇒ n2o n)} one has: lσ = id (id (lim (fun −→ id (lim (fun n’ −→ id (lim (fun n’ −→ lim (fun n’’ ⇒ −→ lim (fun n’’ ⇒

n ⇒ n2o n))) ⇒ id ((fun n ⇒ n2o n) n’))) ⇒ id (n2o n’))) id ((fun n’ ⇒ id (n2o n’)) n’’)) id (id (n2o n’’)))

rσ = id (lim (fun n ⇒ n2o n)) −→ lim (fun n’ ⇒ id ((fun n ⇒ n2o n) n’)) −→ lim (fun n’ ⇒ id (n2o n’))

and they are not equal. It seems that in case when critical pairs are joinable using rewriting under a binder, rules that are outside deﬁnitional part can also be considered as inductive

Towards Rewriting in Coq

125

consequences of the deﬁnition, but then the conversion needs to be functionally extensional (similarly to [34]) and some special care should be payed to the contexts under which rewriting occurs. Summarizing, in many rewriting systems, especially simple ones, deﬁning functions over non-functional inductive types, additional rules are inductive consequences of the complete subsystem. In other rewriting systems, even if we are not sure that this is the case, by [10,45], a terminating, conﬂuent and complete rewriting system cannot lead to inconsistency. In practice it would be best to have two diﬀerent keywords for complete and “not necessarily complete” deﬁnitions by rewriting. For example, the keyword Complete Symbol would mean that the set of rules must be checked for completeness by Coq and rejected if its completeness cannot be proved. The keyword Symbol (without Complete) would not incur any completeness checking and the user would understand that the responsibility for consistency in entirely in his hands.

6

Modularity

A very important issue in an interactive system like Coq is modularity. Coq developments are usually composed of many ﬁles and use the standard library or some libraries developed by third parties. Once the given library ﬁle is checked, Coq metatheory guarantees that the compiled library can be read and included in any development without risking undecidability or logical inconsistency (the latter provided that there are no axioms in the library or the development). In order to retain this status once rewriting is added to Coq one must be very careful to ensure good modularity properties on the rewriting systems included in library ﬁles. In particular it should be impossible to deﬁne a rewrite rule f (x) −→ g(x) in one ﬁle and g(x) −→ f (x) in another one, because loading these two ﬁles together would break strong normalization. Although it is possible to design a new version of Coq in such a way that the whole set of rewriting rules is rechecked every time a new library is loaded, it would be very time consuming and therefore it is not a good solution. Instead, the acceptance criteria for rewrite rules should take modularity into consideration. In other words, the following lemma should hold even if there are some deﬁnitions by rewriting in E1 , E2 and/or J : For all judgments J , if E; E1 J and E; E2 ok then E; E1 ; E2 J . In practice, many modularity problems are avoided by allowing only rewrite deﬁnitions Rew(Γ, R) whose head symbols of the left hand sides of rules come from Γ . It is the case in all examples given in Section 2. The module system. Additional modularity requirements for deﬁnitions by rewriting come from the module system. The Coq module system [14,15] was designed

126

J. Chrząszcz and D. Walukiewicz-Chrząszcz

with adding rewriting in mind. In particular, even though more theoretically advanced module systems existed at the time it was implemented (ﬁrst-class modules, anonymous modules [38,21,22]), a simple named version was chosen, similar to [30], where each module construct must be given a name before being used in terms. Thanks to that, existing syntactic acceptance criteria (see Section 3) can be easily adapted to modules. The module language resembles a simply typed lambda calculus with records and record types. A very important feature is module subtyping, with its subsumption rule permitting to give a less precise type to a module. EM :T E T <: T E M : T This rule is useful in two cases. First, it permits to hide some implementation details of a module in order to be able to change them in the future without aﬀecting other parts of the project. Second, it permits to deﬁne a functor with minimal requirements to its arguments and then apply it to a module at hand with more elements and more precise interface. Once rewriting is added to Coq, deﬁnitions by rewriting will be allowed in module interfaces and in particular in argument types of functors. Since functors can be applied to all modules whose interface is a subtype of the functor argument type, the subtyping on module interfaces has to be extended to interfaces containing deﬁnitions by rewriting. It is clear that the convertibility properties required by the functor argument interface must be satisﬁed by the actual parameter’s interface. Otherwise the functor result would not be well-typed. In [15] no other restrictions on “rewriting-subtyping” are imposed. Note however, that such liberal deﬁnition of subtyping implies very strict modularity properties for the acceptance condition for deﬁnitions by rewriting. This means that the deﬁnition by rewriting must be guaranteed not only to be terminating and conﬂuent in the current environment, but also in an environment, where some module type is replaced by a subtype. For example consider the following module type and functor: Module Type T. Symbol g : bool → bool Rules g true → true. End T. Module F(X:T). Symbol f : bool → nat. Rules f true −→ 0 f false −→ 0 f (X.g false) −→ 1. End F.

Towards Rewriting in Coq

127

The deﬁnition of f inside the functor F is conﬂuent, because no reduction rules are associated with g false and hence there are no critical pairs. Consider a possible implementation M of the module type T and the application of F to M. Module M <: T. Symbol g : bool → bool Rules g true −→ true g false −→ false. End M. Module Z := F M.

Now, the signature of Z is the same as the body of F, but the formal parameter X is replaced by the actual parameter M. This gives the following set of rules deﬁning Z.f: f true −→ 0 f false −→ 0 f (M.g false) −→ 1

which is non-conﬂuent, because on one hand f (M.g false) −→ 1 and on the other hand f (M.g false) −→ f false −→ 0. It turns out that in presence of modules and subtyping, rewrite rules where left-hand sides mentions external symbols whose speciﬁcation may still be completed is very dangerous. The easiest way to prevent this danger is to restrict the left-hand sides of the rewrite rules to contain only the symbols declared by the given rewrite deﬁnition. This is, again, the case in all examples from Section 2. Such restriction however turns out to be quite severe. Consider for example deﬁning mathematical functions over natural numbers. It might be a good idea to add a rule deﬁning how this function behaves for the arguments of the form (a+b), but since + is not deﬁned at the same time, this is impossible. Since + is already completely deﬁned it is unlikely to introduce a new deﬁnition of + which would create more critical pairs. This question, whether it is safe to allow external but completely deﬁned symbols in left hand sides of rewrite rules, deﬁnitely needs to be studied further.

7

Extraction

The possibility to extract executable Ocaml, Haskell or Scheme code from Coq developments is one of the key features of Coq [37,31,32]. In this section we try to analyze the impact of introducing rewriting to Coq on the extraction mechanism. The general problem with rewriting is that it does not immediately correspond to any mechanism present in functional languages. To extract a deﬁnition of a symbol deﬁned by rewriting it is important to check whether this symbol is completely deﬁned or not. If it is not, this means that the symbol is like an axiom and its successful extraction is impossible. If it is complete then, as we explained in Section 5, its deﬁnition can be divided into two parts. The ﬁrst part, which is a complete subset containing the

128

J. Chrząszcz and D. Walukiewicz-Chrząszcz

rules used by the completeness checking procedure, usually consists of pattern matching rules. The second part is the remaining set of rules which, in most cases, are inductive consequences of the ﬁrst part. These rules can also be called shortcut rules and they are only really important if the function’s arguments are not ground terms, which is never the case when a functional program is executed. So it is enough to just translate those rules which have the pattern-matching form and simply leave out all the others. The resulting deﬁnition will include the complete deﬁnition and some of the shortcut rules which have a patternmatching form. Other shortcut rules should simply be dropped or they can be transformed into rewrite rules for optimization, available e.g. in the Glasgow Haskell Compiler. For example the deﬁnition of + from Section 2 could be extracted to the following Ocaml code: (** val plus : nat → nat → nat **) let rec plus n m = match n, m with | O, y → y | x, O → x | S x, y → S (plus x y) | x, S y → S (plus x y);;

The second and fourth lines are not necessary for the completeness of the translation. However, the second line can speed up the deﬁnition if the second argument is O. Unfortunately, the fourth line is never used, even though it could also speed the computation up. Indeed, any natural number which does not match the ﬁrst and the second rule, does match the third one. The associativity rule for + is not extracted, as it is not in the pattern-matching form. The deﬁnition of append is extracted in the following way: (** val append : nat → nat → nlist → nlist → nlist **) let rec append n m ln lm = match n, m, ln, lm with | O, m, Nnil, lm → lm | (S n0), m, Ncons (b, n0’, n1), lm → Ncons (b, (plus n0 m), (append n0 m n1 lm)) | n, O, ln, Nnil → ln;;

A smart extraction procedure should also change the order of the second and third rule, because otherwise one of the ﬁrst two rules always applies and the expected speed up from the third rule can never be achieved. Note also, that an extracted function has the same number of arguments as the original one, but the dependencies between them are broken. Consequently, while append is complete in the Coq world, its extracted version contains non-exhaustive pattern-matching, corresponding to unexpected cases when the list and its declared length do not match. Note however that the same problem it is already present for the extracted version of deﬁnitions by fix and match in the current Coq.

Towards Rewriting in Coq

8

129

Conclusions

The goal of this paper was to present our vision of rewriting in Coq and to summarize the results already known in the ﬁeld. We started from an incremental character of the calculus of constructions with rewriting, the form of the deﬁnitions by rewriting and matching used to apply rewrite rules to terms. Then we discussed such issues as strong normalization, conﬂuence, logical consistency, completeness of deﬁnitions by rewriting, modularity and extraction. We hope that this paper can be a basis for a deeper/more detailed discussion about rewriting in Coq, its future and its alternative views. Moreover we hope that it can serve for comparisons with conceptually diﬀerent extensions of Coq, for example the one described in [24] aiming at extending Coq with decision procedures. Acknowledgements. We would like to thank Paweł Urzyczyn, Frédéric Blanqui and the anonymous referees for their comments on the ﬁrst version of our paper.

References 1. Barbanera, F.: Adding algebraic rewriting to the calculus of constructions: Strong normalization preserved. In: Proceedings of the Second International Workshop on Conditional and Typed Rewriting (1990) 2. Barbanera, F., Fernández, M., Geuvers, H.: Modularity of strong normalization and conﬂuence in the λ-algebraic-cube. In: Proceedings of the Ninth Annual IEEE Symposium on Logic in Computer Science, Paris, France, pp. 406–415. IEEE Comp. Soc. Press, Washington, DC, USA (1994) 3. Barbanera, F., Fernández, M., Geuvers, H.: Modularity of strong normalization in the algebraic-λ-cube. Journal of Functional Programming 7(6), 613–660 (1997) 4. Barras, B., Grégoire, B.: On the role of type decorations in the calculus of inductive constructions. In: Ong, L. (ed.) CSL 2005. LNCS, vol. 3634, pp. 151–166. Springer, Heidelberg (2005) 5. Barthe, G., Grégoire, B., Pastawski, F.: CICˆ: Type-based termination of recursive deﬁnitions in the Calculus of Inductive Constructions. In: Hermann, M., Voronkov, A. (eds.) LPAR 2006. LNCS (LNAI), vol. 4246, pp. 257–271. Springer, Heidelberg (2006) 6. Blanqui, F.: Théorie des Types et Récriture. PhD thesis, Université Paris-Sud (2001) 7. Blanqui, F.: Inductive types in the Calculus of Algebraic Constructions. In: Hofmann, M. (ed.) TLCA 2003. LNCS, vol. 2701, Springer, Heidelberg (2003) 8. Blanqui, F.: Rewriting modulo in Deduction modulo. In: Nieuwenhuis, R. (ed.) RTA 2003. LNCS, vol. 2706, Springer, Heidelberg (2003) 9. Blanqui, F.: A Type-Based Termination Criterion for Dependently-Typed HigherOrder Rewrite Systems. In: van Oostrom, V. (ed.) RTA 2004. LNCS, vol. 3091, pp. 24–39. Springer, Heidelberg (2004) 10. Blanqui, F.: Deﬁnitions by rewriting in the Calculus of Constructions. Mathematical Structures in Computer Science 15(1), 37–92 (2005) 11. Blanqui, F., Jouannaud, J.-P., Okada, M.: The Calculus of Algebraic Constructions. In: Narendran, P., Rusinowitch, M. (eds.) RTA 1999. LNCS, vol. 1631, Springer, Heidelberg (1999)

130

J. Chrząszcz and D. Walukiewicz-Chrząszcz

12. Blanqui, F., Jouannaud, J.-P., Okada, M.: Inductive data type systems. Theoretical Computer Science 272(1–2), 41–68 (2002) 13. Brady, E., McBride, C., McKinna, J.: Inductive families need not store their indices. In: Berardi, S., Coppo, M., Damiani, F. (eds.) TYPES 2003. LNCS, vol. 3085, pp. 115–129. Springer, Heidelberg (2004) 14. Chrząszcz, J.: Implementation of modules in the Coq system. In: Basin, D., Wolﬀ, B. (eds.) TPHOLs 2003. LNCS, vol. 2758, pp. 270–286. Springer, Heidelberg (2003) 15. Chrząszcz, J.: Modules in Type Theory with Generative Deﬁnitions. PhD thesis, Warsaw Univerity and University of Paris-Sud (January 2004) 16. Contejean, E., Marché, C., Monate, B., Urbain, X.: CiME version 2 (2000). Available at http://cime.lri.fr/ 17. The Coq proof assistant. http://coq.inria.fr/ 18. Coquand, T.: Pattern matching with dependent types. In: Proceedings of the Workshop on Types for Proofs and Programs, pp. 71–83, Båstad, Sweden (1992) 19. Coquand, T., Paulin-Mohring, C.: Inductively deﬁned types. In: Martin-Löf, P., Mints, G. (eds.) COLOG-88. LNCS, vol. 417, Springer, Heidelberg (1990) 20. Cornes, C.: Conception d’un langage de haut niveau de répresentation de preuves. PhD thesis, Université Paris VII (1997) 21. Courant, J.: A Module Calculus for Pure Type Systems. In: de Groote, P., Hindley, J.R. (eds.) TLCA 1997. LNCS, vol. 1210, pp. 112–128. Springer, Heidelberg (1997) 22. Courant, J.: Un calcul de modules pour les systèmes de types purs. Thèse de doctorat, Ecole Normale Supérieure de Lyon (1998) 23. Dowek, G., Hardin, T., Kirchner, C.: Theorem proving modulo. Journal of Automated Reasoning 31(1), 33–72 (2003) 24. Jouannaud, J.-P., Blanqui, F., Strub, P.-Y.: Building decision procedures in the calculus of inductive constructions (Submitted) 25. Giménez, E.: Un Calcul de Constructions Inﬁnies et son Application à la Vériﬁcation des Systèmes Communicants. PhD thesis, Ecole Normale Supérieure de Lyon (1996) 26. Giménez, E.: Structural recursive deﬁnitions in type theory. In: Larsen, K.G., Skyum, S., Winskel, G. (eds.) ICALP 1998. LNCS, vol. 1443, pp. 397–408. Springer, Heidelberg (1998) 27. Girard, J.-Y.: Une extension de l’interprétation de Gödel à l’analyse, et son application à l’élimination des coupures dans l’analyse et la téorie des types. In: Proceedings of the 2nd Scandinavian Logic Symposium, pp. 63–92. North-Holland (1971) 28. Jouannaud, J.-P., Okada, M.: Executable higher-order algebraic speciﬁcation languages. In: Proceedings of the Sixth Annual IEEE Symposium on Logic in Computer Science, pp. 350–361. IEEE Comp. Soc. Press, Washington, DC, USA (1991) 29. Jouannaud, J.-P., Rubio, A.: The higher-order recursive path ordering. In: Longo, G. (ed.) Fourteenth Annual IEEE Symposium on Logic in Computer Science, Trento, Italy, IEEE Comp. Soc. Press, Washington, DC, USA (1999) 30. Leroy, X.: Manifest types, modules, and separate compilation. In: Conference Record of the 21st Symposium on Principles of Programming Languages, Portland, Oregon, pp. 109–122. ACM Press, New York (1994) 31. Letouzey, P.: A New Extraction for Coq. In: Geuvers, H., Wiedijk, F. (eds.) TYPES 2002. LNCS, vol. 2646, Springer, Heidelberg (2003) 32. Letouzey, P.: Programmation fonctionnelle certiﬁée – L’extraction de programmes dans l’assistant Coq. PhD thesis, Université Paris-Sud (2004) 33. Müller, F.: Conﬂuence of the lambda calculus with left-linear algebraic rewriting. Information Processing Letters 41(6), 293–299 (1992)

Towards Rewriting in Coq

131

34. Oury, N.: Égalité et ﬁltrage avec types dépendants dans le Calcul des Constructions Inductives. PhD thesis, Université Paris-Sud (2006) 35. Parent, C.: Developing certiﬁed programs in the system Coq - the Program tactic. In: Barendregt, H., Nipkow, T. (eds.) TYPES 1993. LNCS, vol. 806, pp. 291–312. Springer, Heidelberg (1994) 36. Paulin-Mohring, C.: Déﬁnitions inductives en théorie des types d’ordre supérieur. Thèse d’habilitation, Ecole Normale Supérieure de Lyon (1996) 37. Paulin-Mohring, C., Werner, B.: Synthesis of ML programs in the system Coq. Journal of Symbolic Computation 15, 607–640 (1993) 38. Pollack, R.: Dependently typed records in type theory. Formal Aspects of Computing 13, 386–402 (2002) 39. Sozeau, M.: Subset coercions in coq. In: Types for Proofs and Programs, TYPES 2006. LNCS, vol. 4502, Springer, Heidelberg (To appear, 2007) 40. Terese (ed.): Term Rewriting Systems. Cambridge Tracts in Theoretical Computer Science, vol. 55. Cambridge University Press, New York (2003) 41. Walukiewicz-Chrząszcz, D.: Termination of rewriting in the calculus of constructions. In: Despeyroux, J. (ed.) Termination of rewriting in the calculus of constructions. Proceedings of the 2nd Workshop on Logical Frameworks and MetaLanguages, Santa Barbara, California (2000) 42. Walukiewicz-Chrząszcz, D.: Termination of Rewriting in the Calculus of Constructions. PhD thesis, Warsaw University and University Paris XI (2003) 43. Walukiewicz-Chrząszcz, D.: Termination of rewriting in the calculus of constructions. Journal of Functional Programming 13(2), 339–414 (2003) 44. Walukiewicz-Chrząszcz, D., Chrząszcz, J.: Inductive consequences in the calculus of constructions. Draft available at http://www.mimuw.edu.pl/˜chrzaszcz/papers/ 45. Walukiewicz-Chrząszcz, D., Chrząszcz, J.: Consistency and completeness of rewriting in the calculus of constructions. In: Furbach, U., Shankar, N. (eds.) IJCAR 2006. LNCS (LNAI), vol. 4130, pp. 619–631. Springer, Heidelberg (2006) 46. Werner, B.: Méta-théorie du Calcul des Constructions Inductives. PhD thesis, Université Paris VII (1994)

Superdeduction at Work Paul Brauner1 , Clément Houtmann2, and Claude Kirchner3 2

1 INPL & LORIA ENS Cachan & LORIA 3 INRIA & LORIA

Dedicated to Jean-Pierre Jouannaud on the occasion of his 60th birthday Abstract. Superdeduction is a systematic way to extend a deduction system like the sequent calculus by new deduction rules computed from the user theory. We show how this could be done in a systematic, correct and complete way. We prove in detail the strong normalisation of a proof term language that models appropriately superdeduction. We finaly examplify on several examples, including equality and noetherian induction, the usefulness of this approach which is implemented in the lemuridæ system, written in T OM.

1 Introduction Our objective is twofold: – to scale up by an order of magnitude the size of the problems we can deal with; – to downsize by an order of magnitude the time needed for a given development. To this end, we started studying a new version of the calculus of constructions in which user-defined computations expressed by rewrite rules can be made transparent in proof terms. Jean-Pierre Jouannaud [Towards Engineering Proofs, 1999] The design, verification and communication of formal proofs are central in informatics and mathematics. In the later, the notion of proofs has a long and fruitful history which now becomes even richer with a century of experience in its formalization. In informatics, formal proofs are in particular essential to formaly assess safety as well as security properties of digital systems. In this context, proof engineering becomes crucial and relies on a semi-interactive design where human interaction is unavoidable. Moreover, to be well designed, proofs have to be well understood and built. As the size of critical softwares increases dramatically, typically a “simple” automotive cruise control software consists of more than one hundred thousand lines of code, proof methods and tools should also scale-up. This proof engineering process is now mastered with the use of proof assistants like Coq [The04], Isabelle [Pau94], PVS [ORS92], HOL [HOL93], Mizar [Rud92] and large libraries of formalised theories ease this task.

UMR 7503 CNRS-INPL-INRIA-Nancy2-UHP. Campus Scientifique, BP 239, 54506 Vandoeuvre-lès-Nancy Cedex, France.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 132–166, 2007. c Springer-Verlag Berlin Heidelberg 2007

Superdeduction at Work

133

In this context one has to deal with at least two main difficulties. First, proof engineering should scale-up as the theories describing the context become huge and may consist of thousand of axioms and definitions, some of them being quite sophisticated. Second, the proof assistant needs to provide the user with appropriate ways to understand and to guide the proof construction. Both concerns are currently tackled by making libraries available, by providing specific tactics, tacticals or strategies (see typically coq.inria.fr), by integration rewriting [BJO02] and decision procedures [NKK02, Alv00, MQP06] safely into the proof assistants, or by interfacing firstorder automated theorem provers with proof assistants like [BHdN02] or like the use of Zenon in Focal [Pre05]. Indeed these approaches raise the question of structuring the theories of interest. For instance one would like to identify the subtheory of lists or of naturals to apply specific decision procedures, e.g. [KRRT06] and of course finding a good modular structure is one of the first steps in an engineering process. . . . the role of higher-order rewriting is to design a type theoretic frameworks in which computation and deduction are integrated by means of higher-order rewrite rules, while preserving decidability of typing and coherence of the underlying logic . . . Jean-Pierre Jouannaud [Jou05] In this context, we have proposed in [BHK07] a foundational framework making use of three complementary dimensions. First, as pioneered by deduction modulo, the computational axioms should be identified. Typically the definition of addition on naturals ought to be embedded into a congruence modulo which deduction is performed [DHK03]. In this case, the deduction rules like the one of natural deduction or of the sequent calculus are not modified but they are applied modulo a congruence embedding part of the theory. Second, we are proposing a complementary approach where new deduction rules are inferred from part of the theory in a correct, systematic and complete way. Third, the rest of the theory will be used as the context on which all the standard and new deduction rules will act, possibly modulo some congruence. To sum up, a theory is split in three parts Th = Th1 ∪ Th2 ∪ Th3 and instead of + 2 seeking for a proof of Th1 ∪ Th2 ∪ Th3 ϕ, we are building a proof of Th3 ∼Th Th1 ϕ, i.e. we use the theory Th3 to prove ϕ using the extended deduction system modulo the congruence ∼Th1 . We assume that the propositions in Th2 are all proposition rewrite rules, i.e. are of the form ∀x.(P ⇔ ϕ), where P is atomic. To ease the presentation of the main ideas, we will not consider in this paper the case of deduction modulo even if in addition to simplicity it admits unbounded proof size speed-up [Bur07]. We call superdeduction the new deduction system embedding the newly generated deduction rules, and the extended entailment relation is denoted +Th or simply + . Intuitively, a superdeduction rule supplants the folding of an atomic proposition P by its definition ϕ, as done by Prawitz [Pra65], followed by as much introductions as possible of the connectives appearing in ϕ. For instance, the axiom T RANS : ∀x.∀z.(x ≤ z ⇔ ∃y.(x ≤ y ∧ y ≤ z))

134

P. Brauner, C. Houtmann, and C. Kirchner

is translated into a left deduction rule by first applying the rules of the classical sequent calculus to Γ, ∃y.(x ≤ y ∧ y ≤ z) Δ. Then by collecting the premises and the side conditions, we get the new deduction rule: ≤ T RANS L

The right rule: ≤ T RANS R

Γ, x ≤ y, y ≤ z Δ y ∈ FV(Γ ,Δ) Γ, x ≤ z Δ

Γ x ≤ y, Δ Γ y ≤ z, Δ Γ x ≤ z, Δ

is similarly obtained by applying deduction rules to Γ ∃y.(x ≤ y ∧ y ≤ z), Δ. These new deduction rules are quite natural and translate the usual mathematical reasoning w.r.t. this axiom. Let us see on a simple example the difference between a proof in sequent calculus and the corresponding one in the extended deduction system. The proof that T RANS a ≤ b ⇒ b ≤ c ⇒ a ≤ c is the following: AX

AX

a ≤ b, b ≤ c a ≤ b, a ≤ c a ≤ b, b ≤ c b ≤ c, a ≤ c ∧R a ≤ b, b ≤ c a ≤ b ∧ b ≤ c, a ≤ c ∃R a ≤ b, b ≤ c ∃y.(a ≤ y ∧ y ≤ c), a ≤ c ·· AX ·· a ≤ c, a ≤ b, b ≤ c a ≤ c ⇒L ∃y.(a ≤ y ∧ y ≤ c) ⇒ a ≤ c, a ≤ b, b ≤ c a ≤ c ∧L a ≤ c ⇔ ∃y.(a ≤ y ∧ y ≤ c), a ≤ b, b ≤ c a ≤ c ∀L ∀z.(a ≤ z ⇔ ∃y.(a ≤ y ∧ y ≤ z)), a ≤ b, b ≤ c a ≤ c ∀L ∀x.∀z.(x ≤ z ⇔ ∃y.(x ≤ y ∧ y ≤ z)), a ≤ b, b ≤ c a ≤ c ⇒R ∀x.∀z.(x ≤ z ⇔ ∃y.(x ≤ y ∧ y ≤ z)), a ≤ b b ≤ c ⇒ a ≤ c ⇒R ∀x.∀z.(x ≤ z ⇔ ∃y.(x ≤ y ∧ y ≤ z)) a ≤ b ⇒ b ≤ c ⇒ a ≤ c Using superdeduction, the axiom T RANS has been used to generate the new deduction rules above and the proof becomes simply: AX ≤ T RANS R

AX

a ≤ b, b ≤ c b ≤ c, a ≤ c a ≤ b, b ≤ c a ≤ b, a ≤ c a ≤ b, b ≤ c a ≤ c ⇒R a≤bb≤c⇒a≤c ⇒R a≤b⇒b≤c⇒a≤c

It is important to notice that these new rules are not just “macros” collapsing a sequence of introductions into a single one: they apply to a predicate, not a connector, and therefore do not solely contain purely logical informations. This therefore raises non trivial questions solved in [BHK07] and in this paper, like the conditions under which the system is complete or consistent and sufficient conditions to get cut-elimination. Superdeduction is based on previous works on supernatural deduction, a deduction system introduced by Benjamin Wack in [Wac05] and providing a logical interpretation of the ρ-calculus [CK01, CLW03]. Preliminary presentation of superdeduction for

Superdeduction at Work

135

the sequent calculus has been given in [Bra06] and the consistency of such systems is studied in [Hou06]. The superdeduction principle has been presented in [BHK07]. In this context, our contributions are the following: – We first summarize in the next section the general principle defined in [BHK07]: a systematic extension of the classical sequent calculus by new deduction rules inferred from the axioms of the theory that are proposition rewrite rules; We prove in detail that this is correct and complete taking into account permutability problems; Building on Urban’s proof-term language for the sequent calculus [Urb01], we present the simple and expressive calculus proposed in [BHK07] that we show to provide a Curry-Howard-de Bruijn correspondence for superdeduction; Assuming the proposition rewrite system used to extend deduction to be weakly normalising and confluent, we prove in detail that the calculus is strongly normalising and therefore that the theory is consistent since the superdeduction system has the cut-elimination property. – Then, we investigate in Section 3 the consequence of these principles and results for the foundation of a new generation of proof assistants for which we have a first downloadable prototype, lemuridæ (rho.loria.fr). In particular we show how convenient and natural proofs become for instance in higher-order logic, mathematical induction, equational logic. We also examplify the current limitations set to get the general results of previous section. – Finally, we provide in Section 4 the detailed proofs of the results summarized in Section 2.

2 Super Sequent Calculus In this section we recall the principles of superdeduction.

AX

∧L ∨L ∀R ∃R

C ONTRR

Γ, ϕ ϕ, Δ

Γ ϕ, ϕ, Δ

Γ, ϕ1 , ϕ2 Δ

∧R

Γ, ϕ1 ∧ ϕ2 Δ

Γ, ϕ1 Δ

Γ ϕ, Δ Γ ϕ1 , Δ

Γ, ϕ2 Δ

Γ ∀x.ϕ, Δ

x∈ / FV(Γ, Δ)

Γ ϕ[t/x], Δ Γ ∃x.ϕ, Δ

∃L

Γ, ϕ, ϕ Δ

∨R ∀L

Γ ϕ2 , Δ

Γ, ϕ Δ Γ, ∃x.ϕ Δ

Γ ϕ1 , ϕ2 , Δ

R ⇒R

Γ ϕ1 ∨ ϕ2 , Δ

Γ, ϕ[t/x] Δ Γ, ∀x.ϕ Δ x∈ / FV(Γ, Δ)

⊥L

Γ, ϕ Δ

Γ ϕ1 ∧ ϕ2 , Δ

Γ, ϕ1 ∨ ϕ2 Δ

Γ ϕ, Δ

C ONTRL

⇒L

Γ , Δ

Γ, ϕ1 ϕ2 , Δ Γ ϕ1 ⇒ ϕ2 , Δ

Γ ϕ1 , Δ

C UT

Γ, ⊥ Δ

Γ, ϕ2 Δ

Γ, ϕ1 ⇒ ϕ2 Δ Γ ϕ, Δ

Γ, ϕ Δ

Γ Δ

Fig. 1. Classical sequent calculus

As mentioned in the introduction and similarly as in deduction modulo, we focus our attention to formulæ of the form ∀x.(P ⇔ ϕ) where P is atomic:

136

P. Brauner, C. Houtmann, and C. Kirchner

Definition 1 (Propositions rewrite rule). The notation R : P → ϕ denotes the axiom ∀x.(P ⇔ ϕ) where R is a name for it, P is an atomic proposition, ϕ some proposition and x their free variables. Notice that P may contain first-order terms and therefore that such an axiom is not just a definition. For instance, isZero(succ(n)) → ⊥ is a proposition rewrite rule. For the classical sequent calculus, let us now describe how the computation of the superdeduction new inference rules is performed. Definition 2 (Super sequent calculus rules computation). Let Calc be a set of rules composed by the subset of the sequent calculus deduction rules formed of A X, ⊥L , R , ∨L , ∨R , ∧L , ∧R , ⇒L , ⇒R , ∀L , ∀R , ∃L and ∃R , as well as of the two following rules

L and ⊥R L

Γ Δ Γ, Δ

⊥R

Γ Δ Γ ⊥, Δ

Let R : P → ϕ be a proposition rewrite rule. 1. To get the right rule associated with R, initialise the procedure with the sequent Γ ϕ, Δ. Next, apply the rules of Calc until no more open leave remain on which they can be applied. Then, collect the premises, the side conditions and the conclusion and replace ϕ by P to obtain the right rule RR . 2. To get the left rule RL associated with R, initialise the procedure with the sequent Γ, ϕ Δ. apply the rules of Calc and get the new left rule the same way as for the right one. Definition 3 (Super sequent calculus). Given a proposition rewrite system R, the super sequent calculus associated with R is formed of the rules of classical sequent calculus and the rules built upon R. The sequents in such a system are written Γ +R Δ. To ensure good properties of the system, we need to put some restrictions on the axioms though. Although the deduction rules of the classical sequent calculus propositional fragment may be applied in any order to reach axioms, the application order of rules concerning quantifiers is significant. Let us consider the following cases: AX

P (x0 ) P (x0 ) ∀x.P (x) P (x0 ) ∀x.P (x) ∀x.P (x)

∀L ∀R

∀L

P (t) ∀x.P (x) ∀x.P (x) ∀x.P (x)

The left-hand side proof succeeds because the early application of the ∀R rule provides the appropriate term for instantiating the variable of the proposition present in the context. On the other hand, the second proof cannot be completed since the ∀R side condition requires the quantified variable to be substituted for a fresh one. Such a situation may occur when building the super sequent calculus custom rules and therefore may break its completeness w.r.t. classical predicate logic. This common permutability problem of automated proof search appears here since superdeduction systems are

Superdeduction at Work

137

in fact embedding a part of compiled automated deduction. Thereby we apply an idea inspired by focusing techniques [And92, AM99, And01], namely replacing every subformula of ϕ leading to a permutability problem by a fresh predicate symbol parameterised by the free variables of the subformula. To formalise this, we first need to recall the polarity notion: Definition 4 (Polarity of a subformula). The polarity polϕ (ψ) of ψ in ϕ where ψ is a subformula occurrence of ϕ is a boolean defined as follows: – if ϕ = ψ, then polϕ (ψ) = 1; – if ϕ = ϕ1 ∧ ϕ2 or ϕ1 ∨ ϕ2 , then polϕ (ψ) = polϕ1 (ψ) if ψ is a subformula occurrence of ϕ1 , polϕ2 (ψ) otherwise; – if ϕ = ∀x.ϕ1 or ∃x.ϕ1 , then polϕ (ψ) = polϕ1 (ψ); – if ϕ = ϕ1 ⇒ ϕ2 , then polϕ (ψ) = ¬polϕ1 (ψ) if ψ is a subformula occurrence of ϕ1 , polϕ2 (ψ) otherwise. Definition 5 (Set of permutability problems). A formula ψ is in the set PP (ϕ) of ϕ permutability problems if there exists ϕ a subformula of ϕ such that ψ is a subformula occurrence of ϕ and one of these propositions holds: – – – –

ϕ ϕ ϕ ϕ

= ∀x.ϕ1 , ψ = ∃x.ϕ1 , ψ = ∀x.ϕ1 , ψ = ∃x.ϕ1 , ψ

= ∀x.ψ1 = ∃x.ψ1 = ∃x.ψ1 = ∀x.ψ1

and polϕ (ψ) = 0 and polϕ (ψ) = 0 and polϕ (ψ) = 1 and polϕ (ψ) = 1

This allows us to define the most appropriate generalisation of a proposition rewrite rule R : P → ϕ: Definition 6 (Set of delayed proposition rewrite rules). This is the set: Dl Qi → ϕi Dl(R : P → ϕ) = {P → C Q1 (x1 ), . . . , Qn (xn ) } i=1...n

such that: – C is the largest context in ϕ with no formula in PP (ϕ) such that ϕ = C[ϕ1 . . . ϕn ]; – ∀i ∈ {1 . . . n}, xi is the vector of ϕi free variables; – Q1 . . . Qn are fresh predicate symbols. As an example, let us consider the proposition rewrite rule defining the natural numbers as the set of terms verifying the inductive predicate: ∈N : N(n) → ∀P.(0 ∈ P ⇒ ∀m.(m ∈ P ⇒ s(m) ∈ P ) ⇒ n ∈ P ) This axiom can be found in [DW05] which introduces an axiomatisation of constructive arithmetic with rewrite rules only. It uses a simple second-order encoding by expressing quantification over propositions by quantification over classes; x ∈ P should therefore be read as P (x). The delayed set Dl(∈N ) of proposition rewrite rules derived from the rules above is: ∈N : N(n) → ∀P.(0 ∈ P ⇒ H(P ) ⇒ n ∈ P ) hered : H(P ) → ∀m.(m ∈ P ⇒ s(m) ∈ P )

138

P. Brauner, C. Houtmann, and C. Kirchner

Let us notice that the proposition H(P ) revealed by the elimination of permutability problems expresses heredity, a well-known notion. Focussing on parts of the propositions which raise some non-trivial choice at some phase on the proof has been naturally done by mathematicians. Then we obtain the following deduction rules for the natural numbers definition: ∈NL

Γ + 0 ∈ P, Δ

∈NR

Γ + H(P ), Δ Γ, N(n) + Δ

Γ, n ∈ P + Δ

0 ∈ P, H(P ) + n ∈ P, Δ P ∈ FV(Γ, Δ) Γ + N(n), Δ

The left rule translates exactly the usual induction rule. The hered proposition rewrite rule generates new deduction rules too: heredL

heredR

Γ + m ∈ P, Δ Γ, s(m) ∈ P + Δ Γ, H(P ) + Δ Γ, m ∈ P + s(m) ∈ P, Δ m ∈ FV(Γ, Δ) Γ + H(P ), Δ

Once again, the right rule corresponds to the usual semantics of heredity. Main properties of the super sequent calculus associated with a delayed set of axioms are its soundness and completeness w.r.t. classical predicate logic. Theorem 1 (Soundness and completeness of super sequent calculus). Given Th an axiomatic theory made of axioms of the form ∀x.(P ⇔ ϕ) with P atomic and R the associated proposition rewrite rules, every proof of Γ Dl(R) Δ in super sequent calculus can be translated into a proof of Γ, Th Δ in sequent calculus (soundness) and conversely (completeness). Proof. Soundness. This is easily proved by replacing every occurrence of a superrule RR obtained from P → ϕ by the partial proof derived during its computation. Then by translating the unfolding step by an application of ⇒L . πR Γ, Th, P P, Δ Γ, Th, ϕ Δ ⇒L Γ, Th, P ⇒ ϕ P, Δ ∧L Γ, Th, P ⇔ ϕ, P Δ ∀L ... ∀L Γ, Th, ∀x.(P ⇔ ϕ), P Δ C ONTRL Γ, Th, P Δ AX

The left case is symmetric.

Superdeduction at Work

139

Completeness. Let π be the proof of Γ, Th Δ. By cutting the conclusion on Th, the problem is brought down to proving the axioms of Th in the super sequent calculus. π ... Γ Th, Δ Γ, T h +R Δ Γ +R Δ +R

C UT

This is done by induction on the derivations of RR and RL for each rewrite rule R of R. The full proof is in [Bra06]. A proof-term language for superdeduction has been designed in [BHK07] together with a cut-elimination procedure shown to be strongly normalising under appropriate properties. We will recall its definition now and the full proofs of the strong normalisation property will be written in Section 4. This proof-term language is based upon Christian Urban’s work on cut-elimination for classical sequent calculus [Urb00, Urb01, UB01, Len03, vBLL05]. The main difference between Urban’s proof-terms and other ¯ μ-calculus [Her95, CH00, Wad03] is that no approaches such as Hugo Herbelin’s λμ˜ focus is made on a particular formula of a sequent Γ Δ, and thus a proof-term M always annotate the full sequent. Such typing judgements are denoted M Γ Δ. It is explained in [BHK07] why this difference between Urban’s and Herbelin’s approaches made us choose the first one to base our proof-terms for superdeduction upon. Urban’s proof-term language for classical sequent calculus makes no use of the firstclass objects of the λ-calculus such as abstractions or variables. Variables are replaced by names and conames. Let X and A be respectively the set of names and the set of conames. Symbols x, y, . . . will range over X while symbols a, b, . . . will range over A. Symbols x, y, . . . will range over the set of first-order variables. Left-contexts and right-contexts are sets containing respectively pairs x : ϕ and pairs a : ϕ. Symbol Γ will range over left-contexts and symbol Δ will range over the right-contexts. Moreover, contexts cannot contain more than one occurrence of a name or coname. We will never omit the ‘first-order’ in ‘first-order term’ in order to avoid confusion with ‘terms’ (i.e. proof-terms). The set of terms is defined as follows. N ) | FalseL (x) | TrueR (a) M, N ::= Ax(x, a) | Cut( aM, x | AndR ( aM, bN, c) | AndL ( xyM, z) | OrR ( abM, c) | OrL ( xM, yN, z) x aM, b) | ImpL ( xM, aN, y) | ExistsR ( aM, t, b) | ExistsL ( x xM, y) | ImpR ( | ForallR ( a xM, b) | ForallL ( xM, t, y) ¯ μ-calculus Names and conames are not called variables and covariables such as in λμ˜ since they do not represent places where terms might be inserted. They still may appear bound: the symbol «» is the unique binder of the calculus and thus we can compute the sets of free and bound names, conames and first-order variables in any term. We consequently adopt Barendregt’s convention on names, conames and first-order variables: in a term or in a statement a name, a coname or a first-order variable is never both bound and free in the same context. The type system is expressed in Figure 2. The differences with Urban’s type system Γ ϕ1 , ϕ2 , Δ Γ ϕi , Δ ∨R ∨R -i Γ ϕ1 ∨ ϕ2 , Δ instead of Γ ϕ1 ∨ ϕ2 , Δ for i ∈ {1, 2} is the use of

140

P. Brauner, C. Houtmann, and C. Kirchner

and similarly for ∧. A comma in a conclusion stands for the set union and a comma in a premise stands for the disjoint set union. This allows our type inference rules to contain implicit contraction. A term M introduces the name z if it is of the form Ax(z, a), FalseL (z), AndL ( xyM, z), OrL ( xM , yN, z), ImpL ( xM, aN, z), ExistsL ( x xM, z), ForallL ( xM, t, z), and it introduces the coname c is it is of the form Ax(x, c), TrueR (c), AndR ( aM, bN, c), OrR ( abM, c), ImpR ( x aM, c), ExistsR ( aM, t, c), ForallR ( a xM, c). A term M freshly introduces a name or a coname if it introduces it, but none of its proper subterms. It means that the corresponding formula is introduced at the top-level of the proof, but not implicitly contracted and consequently introduced in some subproof. cut Figure 3 presents a (non-confluent) cut-elimination procedure denoted −→ proven to be strongly normalising on well-typed terms in [Urb00, UB01]. It is complete in the sense that irreducible terms are cut-free. M [b → a] stands for the term M where every free occurrence of the coname b is rewritten to a (and similarly for Q[y → x]). Besides, the proof substitution operation denoted M [a := x N ] and its dual M [x := aN ] are defined in Figure 4.

AX

⊥L

M Γ a : ϕ, Δ

∨R

R

FalseL (x) Γ, x : ⊥ Δ

M Γ a : ϕ1 , b : ϕ 2 , Δ OrR (b ab bM, c) Γ c : ϕ1 ∨ ϕ2 , Δ M Γ, x : ϕ1 a : ϕ2 , Δ ImpR (b xb aM, b) Γ b : ϕ1 ⇒ ϕ2 , Δ ∃L

∃R

∧L

TrueR (a) Γ a : , Δ M Γ, x : ϕ1 , y : ϕ2 Δ AndL (b xybM, z) Γ, z : ϕ1 ∧ ϕ2 Δ

M Γ, x : ϕ1 Δ

⇒L

M Γ, x : ϕ2 Δ N Γ a : ϕ1 , Δ ImpL (b xM, b aN, y) Γ, y : ϕ1 ⇒ ϕ2 Δ

M Γ, x : ϕ Δ

M Γ a : ϕ[x := t], Δ

N Γ, y : ϕ2 Δ

OrL (b xM, ybN, z) Γ, z : ϕ1 ∨ ϕ2 Δ

ExistsL (b xb xM, y) Γ, y : ∃x.ϕ Δ

ExistsR (b aM, t, b) Γ b : ∃x.ϕ, Δ ∀R

∨L

N Γ, x : ϕ Δ

Cut(b aM, x bN ) Γ Δ

M Γ a : ϕ1 , Δ N Γ b : ϕ2 , Δ AndR (b aM, b bN, c) Γ c : ϕ1 ∧ ϕ2 , Δ

∧R

⇒R

C UT

Ax(x, a) Γ, x : ϕ a : ϕ, Δ

∀L

x∈ / FV(Γ, Δ)

M Γ, x : ϕ[x := t] Δ ForallL (b xM, t, y) Γ, y : ∀x.ϕ Δ

M Γ a : ϕ, Δ ForallR (b ab xM, b) Γ b : ∀x.ϕ, Δ

x∈ / FV(Γ, Δ)

Fig. 2. Type system

Now let us extend Urban’s proof-term language for superdeduction. During the computation of the deduction rules for some proposition rewrite rule, the procedure computes an open derivation where two kinds of information still need to be provided:

Superdeduction at Work

141

Logical Cuts: cut

Cut(b aM, x bAx(x, b)) −→ M [a → b]

if M freshly introduces a

cut

if M freshly introduces x

cut

if M freshly introduces x

Cut(b aAx(y, a), x bM ) −→ M [x → y] bM ) −→ M Cut(b aTrueR (a), x cut

if M freshly introduces a Cut(b aM, x bFalseL (x)) −→ M ( Cut(b bM1 , ybCut(b cM2 , zbN )) cut bM1 , b cM2 , a), x bAndL (b y zbN, x)) −→ Cut(b aAndR (b bM1 , ybN )) Cut(b cM2 , zbCut(b if AndR (b bM1 , b cM2 , a) and AndL (b y zbN, x) freshly introduce a and x ( b Cut(bCut(b cM, zbN2 ), ybN1 ) cut bb cM, a), x bOrL (b y N1 , zbN2 , x)) −→ Cut(b aOrR (b Cut(b cCut(b bM, ybN1 ), zbN2 ) if OrR (b bb cM, a) and OrL (b y N1 , zbN2 , x) freshly introduce a and x ( Cut(b bCut(b cN2 , x bM ), zbN1 ) cut xb bM, a), ybImpL (b z N1 , b cN2 , y)) −→ Cut(b aImpR (b bCut(b bM, zbN1 )) Cut(b cN2 , x if Imp (b xb bM, a) and Imp (b z N1 , b cN2 , y) freshly introduce a and y R

L

cut bM, t, a), x bExistsL (b yb xN, x)) −→ Cut(b bM, ybN [x := t]) Cut(b aExistsR (b b yb xN, x) freshly introduce a and x if ExistsR (bM, t, a) and ExistsL (b cut bb xM, a), x bForallL (b y N, t, x)) −→ Cut(b bM [x := t], ybN ) Cut(b aForallR (b bb xM, a) and ForallL (b y N, t, x) freshly introduce a and x if ForallR (b

j

Commuting Cuts: Cut(b aM, x bN ) −→ cut

M [a := x bN ] N [x := b aM ]

if M does not freshly introduce a, or if M does not freshly introduce x

Fig. 3. Urban’s cut-reductions

(1) premises that remain to be proved and (2) first-order terms written at a metalevel by rules ∃R and ∀L that still remain to be instantiated. In order to represent these, we use a formal notion of open-terms: terms that contains (1) open leaves that represent premises that remain to be proved and are denoted , and (2) placeholders for first-order terms that represent uninstantiated first-order terms and are denoted by α, β, . . . Substitutions over placeholder-terms are written [α := t, . . . ] and are defined over first-order terms, formulæ, sequents, and terms. The syntax of open-terms is then: C, D ::= Γ Δ | Ax(x, a) | Cut( aC, x D) | ... aC, α, b) | ExistsL ( x xC, y) | ExistsR ( | ForallR ( a xC, b) | ForallL ( xC, α, y) Urban’s cut-elimination procedure is extended to open-terms in the obvious way. Typing is also extended to open-terms by adding the following rule to the type inference rules of Figure 2. ( Γ Δ) Γ Δ

142

P. Brauner, C. Houtmann, and C. Kirchner Ax(x, c)[c := yM ] Ax(y, a)[y := cM ] AndR (aM1 , bM2 , c)[c := yN ] AndL (xyM, z)[z := aN ] ... ExistsR (aM, t, b)[b := xN ] ExistsL (xxM, y)[y := aN ] ... Otherwise : Ax(x, a)[ϑ] Cut(aM, xN )[ϑ] AndR (aM1 , bM2 , c)[ϑ] AndL (xyM, z)[ϑ] ... ExistsR (aM, t, b)[ϑ] ExistsL (xxM, y)[ϑ] ...

M [y → x] M [c → a] Cut(cAndR (aM1 [c := yN ], bM2 [c := yN ], c), yN ) Cut(aN, zAndL (xyM [z := aN ], z)) Cut(bExistsR (aM [b := xN ], t, b), xN ) Cut(aN, yExistsL (xxM [y := aN ], y))

Ax(x, a) Cut(aM [ϑ], xN [ϑ]) AndR (aM1 [ϑ], bM2 [ϑ], c) AndL (xyM [ϑ], z) ExistsR (aM [ϑ], t, b) ExistsL (xxM [ϑ], y)

Fig. 4. Proof Substitution

These leaves will be denoted for short Γ Δ . Type inference derivation for openterms are called open type inference derivations. Their open leaves are the later leaves, i.e. the open leaves of the open-term. For some open-term C, its number of occurrences of is denoted nC . Then for some placeholder-term substitution σ = [α1 := t1 , . . . , αp := tp ] where all placeholder-terms appearing in C are substituted by σ (we say that σ covers C) and for M1 , . . . , MnC some terms, we define the term σC[M1 , . . . , MnC ] as follows. – if C is a term and nC = 0 then trivially σC[] σC ; – if C = Γ Δ and nC = 1 then σC[M ] M ; – if C = AndR ( aC1 , bC2 , c)[M1 , . . . , MnC ] then aσC1 [M1 , . . . , MnC1 ], bσC2 [MnC1 +1 , . . . , MnC ], c); σC[M1 , . . . , MnC ] AndR ( x xC1 , y), then – if C = ExistsL ( σC[M1 , . . . , MnC ] ExistsL ( x xσC1 [M1 , . . . , MnC ], y) ; – if C = ExistsR ( aC1 , α, b), then σC[M1 , . . . , MnC ] ExistsR ( aσC1 [M1 , . . . , MnC ], σα, b) ; – the other remaining cases are similar. Let us define now the extended terms and reduction rules associated with the proposition rewrite rule R : P → ϕ. For some formula ϕ, for x and a some name and coname, the open-terms denoted | a : ϕ | and | x : ϕ | are defined as follows.

Superdeduction at Work

| Γ Δ | | Γ, x : ϕ a : ϕ, Δ | | Γ a : ϕ1 ⇒ ϕ2 , Δ | | Γ, x : ϕ1 ⇒ ϕ2 Δ | | Γ a : ϕ1 ∨ ϕ2 , Δ | | Γ, x : ϕ1 ∨ ϕ2 Δ | | Γ a : ϕ1 ∧ ϕ2 , Δ | | Γ, x : ϕ1 ∨ ϕ2 Δ | | Γ a : ∃x.ϕ, Δ | | Γ, x : ∃x.ϕ Δ | | Γ a : ∀x.ϕ, Δ | | Γ, x : ∀x.ϕ Δ |

143

Γ Δ if Γ and Δ only contain atomic formulæ Ax(x, a) ImpR ( xb| Γ, x : ϕ1 b : ϕ2 , Δ |, a) ImpL ( y | Γ, y : ϕ2 Δ |, a| Γ a : ϕ1 , Δ |, x) OrR (b c| Γ b : ϕ1 , c : ϕ2 , Δ |, a) OrL ( y | Γ, y : ϕ1 Δ |, z| Γ, z : ϕ2 Δ |, x) AndR (b| Γ b : ϕ1 , Δ |, c| Γ c : ϕ2 , Δ |, a) AndL ( y z| Γ, y : ϕ1 , z : ϕ2 Δ |, x) ExistsR (b| Γ b : ϕ[x := α], Δ |, α, a) α is fresh y x| Γ, y : ϕ Δ |, x) if x ∈ / F V(Γ, Δ) ExistsL ( ForallR (b x| Γ b : ϕ, Δ |, a) if x ∈ / F V(Γ, Δ) y | Γ, y : ϕ[x := α] Δ |, α, x) α is fresh ForallL (

The definition is non-deterministic just as the definition of new deduction rules in super sequent calculus systems. We may pick any of the possibilities just as we do for the computation of new deduction rules. We prove the following lemma, which states the adequacy of the typing of | a : ϕ | (resp. | x : ϕ |) with the right (resp. left) superdeduction rule associated with a proposition rewrite rule P → ϕ. Lemma 1. Let R : P → ϕ be some proposition rewrite rule and let C be the openterm | a : ϕ |. Then, for any instance of the right rule RR having Γ a : P, Δ as its conclusion, C Γ a : ϕ, Δ is well-typed, and moreover there exists some substitution σ for placeholder-terms covering C such that the sequents in the premises of C substituted by σ are the premises of this instance of RR . Proof. By construction, an instance of RR can be transformed into a decomposition of the logical connectors of ϕ, and thus into some open type inference of C Γ a : ϕ, Δ, by construction of C. The substitution σ substitutes for the placeholder-terms in this open type inference derivation the terms that are used in this instance of RR . We obtain thus that the sequents in the premises of C substituted by σ are the premises of this instance of RR . An analogous version of Lemma 1 can be proven for the introduction of P on the left. We propose the type inference rules presented as follows for introducing P on the left and on the right. Mi Γ, xi1 : Ai1 , . . . , xipi : Aipi ai1 : B1i , . . . , aiqi : Bqi i , Δ 1in RR C

i i

i i RR x1 . . . xp , x1 . . . xpi a1 . . . aqi Mi , α1 , . . . , αq , a Γ a : P, Δ 1in

n is the number of open leaves of | a : ϕ |. The side condition C is the side condition of the corresponding rule in the super sequent calculus. The first-order variables x1 , . . . , xp are the variables concerned by this side condition and by Lemma 1, they are the bound first-order variables of | a : ϕ |. The α1 , . . . , αq are the placeholderterms appearing in this later open-term. When using this type inference rule, these

144

P. Brauner, C. Houtmann, and C. Kirchner

placeholder-terms are to be instantiated by first-order terms in the proof-terms as in the formulæ.

Nj Γ, y1j : C1j , . . . , yrjj : Crjj bj1 : D1j , . . . , bjsj : Dsjj , Δ 1jm RL C j

j j j RL y1 . . . yr , y1 . . . yrj b1 . . . bsj Nj , β1 , . . . , βs , x Γ, x : P Δ 1jm

m is the number of open leaves of | x : ϕ |. The side condition C is the side condition of the corresponding rule in the super sequent calculus. The first-order variables y1 , . . . , yr are the variables concerned by this side condition and by the version of Lemma 1 for introducing P on the left, they are the bound first-order variables of | x : ϕ |. The β1 , . . . , βs are the placeholder-terms appearing in this later open-term. By duality it is expected that p = s and q = r. When using this type inference rule, these placeholder-terms are to be instantiated by first-order terms in the proof-terms as in the formulæ. We obtain the extended proof-terms for a super sequent calculus system. Proofs substitutions are extended in the obvious way on proof-terms. cut excut The extended cut-elimination associated with −→, denoted −→, is defined as follows. For each proposition rewrite rule R : P → ϕ, for each reduction cut +

Cut( a| a : ϕ |, x | x : ϕ |) −→ C cut

cut

where C is a normal form for −→, we add to −→ the following rewrite rule.

i . . . x

i ai . . . a i M ,α . . . α , a , σCut aRR x1 . . . xp , x i 1 q 1

pi 1

qi

1in

j

j j j x RL y1 . . . yr , y1 . . . yrj b1 . . . bsj Nj , β1 . . . βs , x 1jm excut

−→ σC[M1 , . . . , Nm ]

if RR (. . . ) and RL (. . . ) freshly introduce a and x Here σ substitutes for each placeholder-term a first-order term. However these terms are meta just as the symbol t in the eighth and ninth rules of Figure 2. excut The cut-elimination −→ is complete: any instance of a cut is a redex and thus a excut normal form for −→ is cut-free. An important result of [BHK07] is the following theorem. Theorem 2 (Strong Normalisation). Let us suppose that the set of proposition rewrite rules R is such that for each of its rules R : P → ϕ: – P contains only first-order variables (no function symbol or constant); – F V(ϕ) ⊆ F V(P );

Superdeduction at Work

145

prop

and such that the rewrite relation −→ associated with R is weakly normalising and excut confluent. Then −→ is strongly normalising on well-typed extended terms. The proof of this theorem is detailed in Section 4. It uses the normal forms of formulæ prop through the rewrite relation −→ to translate proofs in superdeduction into proofs in prop usual sequent calculus and thus requires that −→ is weak normalising and confluent. Besides the translation of existential/universal rules requires the two other hypothesis, as it will be explained by a precise counter-example in Section 3. It is interesting to notice that since Hypothesis 1 implies the cut-admissibility in the super sequent calculus system, and since this system is sound and complete w.r.t. predicate logic, it implies the consistency of the corresponding first-order theory.

3 A Foundation for New Proof Assistants The first strong argument in favour of proof assistants based on superdeduction is the representation of proofs. Indeed, existing proof assistants such as C OQ, Isabelle or PVS are based on the proof planning paradigm, where proofs are represented by a succession of applications of tactics and of tacticals. C OQ also builds a proof-term, in particular to bring the proof check down to a micro kernel. In these approaches, the witness of the proof is bound to convince the user that the proof is correct but not to actually explain it, as usual mathematical proofs often also do. Even if the proof-terms of C OQ are displayed as trees or under the form of natural language text, the main steps of the proof are drown in a multitude of usually not expressed logical arguments due to both the underlying calculus and the presence of purely computational parts, e.g. the proof that 2 + 3 equals 5. Deduction modulo is a first step forward addressing this later issue by internalising computational aspects of a theory inside a congruence. With the canonical rewrite system on naturals, P (2 + 3) P (5) becomes an axiom. However a congruence defined by proposition rewrite rules whose right-hand side is not atomic does not bring the expected comfort to interactive proving: the choice of a proposition representative in the congruence introduces some nondeterminism which is neither useful nor wanted. Superdeduction solves this problem by narrowing the choice of a deduction rule to the presence in the goal of one of the extended deduction rules conclusions and goes a step further by also eliminating trivial logical arguments in a proof. Thereby, superdeduction provides a framework for naturally building but also communicating and understanding the essence of proofs. Notice that extended deduction rules contain only atomic premises and conclusions, thus proof building in this system is like plugging in theorems, definitions and axioms together. This points out the fact that logical arguments of proofs are actually encoded by the structure of theorems, which explains why they are usually not mentionned. Another important aspect of superdeduction is its potential ability to naturally encode custom reasoning schemes. Let us see how superdeduction behaves in practice when confronted to common situations of theorem proving.

146

P. Brauner, C. Houtmann, and C. Kirchner

3.1 Higher-Order Logic An interesting case is the encoding of other logics like higher-order logic which has been expressed through proposition rewrite rules in [Dow97]. As an example, the propo˙ x)) → ∀y. (α(x, y)) is translated into the following deduction sition rewrite rule (α(∀, rules which mimic the deduction rules of higher-order logic. Γ, (α(x, t)) + Δ ˙ x)) + Δ Γ, (α(∀,

Γ + (α(x, y)), Δ (y ∈ / FV(Γ )) ˙ x)), Δ Γ + (α(∀,

The interesting point is that this behaviour is not encoded inside the underlying logic but is the result of the chosen theory which is only a parameter of the system. 3.2 Induction Another application field of superdeduction is the handling of induction schemes, introduced in Section 2 with the example of structural induction over Peano naturals. Let us carry on this by proving that every natural number is either odd or even in the super sequent calculus. We start by defining the predicates even and odd with the following three proposition rewrite rules. zero : Even(0) → even : Even(s(n)) → Odd(n) odd : Odd(s(n)) → Even(n) This leads to six simple folding and unfolding rules. zeroL

evenL

oddL

Γ +R Δ Γ, Even(0) +R Δ

Γ, Odd(n) +R Δ Γ, Even(s(n)) +R Δ Γ, Even(n) +R Δ Γ, Odd(s(n)) +R Δ

zeroR

evenR

oddR

Γ +R Even(0), Δ

Γ +R Odd(n), Δ Γ +R Even(s(n)), Δ Γ +R Even(n), Δ Γ +R Odd(s(n)), Δ

Finally, let us recall that the derived inference rules for induction encode second-order reasoning by the use of classes, i.e. constants standing for propositions. For instance, ˙ class represents the Odd predicate, we add the following axiom assuming that the odd ˙ ⇔ Odd(x)). Here, since we want to prove to the context of the proof : ∀x.(x ∈ odd that every natural is either odd or even, we introduce the ooe ˙ class which encodes the latter proposition. This is done through a proposition rewrite rule: oddoreven : n ∈ ooe ˙ → Odd(n) ∨ Even(n) This leads to the creation of two new deduction rules for the super sequent calculus. oddorevenL

Γ, Odd(n) +R Δ Γ, Even(n) +R Δ Γ, n ∈ ooe ˙ +R Δ

oddorevenR

Γ +R Odd(n), Even(n), Δ Γ +R n ∈ ooe, ˙ Δ

Superdeduction at Work

147

We finally can build a proof of n ∈ N +R Odd(n) ∨ Even(n), which is depicted by Figure 5 (some weakening steps are left implicit to lighten the proof tree). Let us call respectively Π1 , Π2 and Π3 the premises of the ∈NL rule. The proof appears to be rather readable compared to a proof of the same proposition in classical sequent calculus: we start by proving that zero is even or odd (Π1 ), then that the even or odd property is hereditary (Π2 ) by using the deduction rules translating the definitions of even, odd and zero. Then we prove that the proposition holds for every integer by using the induction principle expressed by rule ∈NL . The subproof Π3 is purely axiomatic and would be typically automated in a proof assistant. AX oddorevenL

Odd(n) +R Odd(n), Even(n) n ∈ ooe ˙ AX

evenR

+R

AX

Even(n) +R Odd(n), Even(n)

Odd(n), Even(n)

Odd(m) +R Odd(m)

Odd(m) +R Odd(s(m)), Even(s(m)) ·· AX ·· Even(m) +R Even(m) ·· oddR ·· Even(m) +R Odd(s(m)), Even(s(m)) oddorevenL m ∈ ooe ˙ +R Odd(s(m)), Even(s(m)) oddorevenR m ∈ ooe ˙ +R s(m) ∈ ooe ˙ heredR +R H(ooe), ˙ Odd(n), Even(n) ·· ·· zeroR +R ·· Odd(0), Even(0) ·· oddorevenR +R ·· 0 ∈ ooe, ˙ Odd(n), Even(n) ∈NL +R n∈N Odd(n), Even(n) ∨R n ∈ N +R Odd(n) ∨ Even(n)

·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ··

Fig. 5. Proof of n ∈ N +R Odd(n) ∨ Even(n)

Let us remark that in a framework mixing superdeduction and deduction modulo, Π3 would be immediately closed by an axiom, while the encoding of second order by classes could hardly disappear everywhere in the proof tree. Indeed, the proposition m ∈ ooe ˙ for instance would be equal to Odd(m) ∨ Even(m) +R Odd(s(m)) ∨ Even(s(m)) modulo R, which would hide the explicit decoding by the successive applications of oddorevenR and oddorevenL . The study of such a deduction system is an active research topic. One may argue that this approach is not viable within the framework of proof assistants because it requires to virtually provide a class for each constructible proposition of the language. This would lead to the introduction of an infinite number of constants symbols, as well as an infinity of associated “decoding” axioms. This problem is addressed in [Kir06] which proposes a finite axiomatisation of the theory of classes. The

148

P. Brauner, C. Houtmann, and C. Kirchner

basic idea is to introduce a constant symbol along with its decoding axiom for each predicate symbol of the discourse. They shall be a finite number of them. As an example, let us encode Odd and Even: decodeeven : x ∈ even ˙ → Even(x) ˙ → Odd(x) decodeodd : x ∈ odd However this time, classes encoding complex propositions are built over this finite set of constants using function symbols encoding logical connectors. For instance, the ∪ function symbol encodes the ∨ connector: decodeunion : x ∈ a ∪ b → x ∈ a ∨ x ∈ b ˙ ∪ even This entails the encoding of the proposition Odd(x) ∨ Even(x) by the x ∈ odd ˙ one. The difficulty of such an approach is the handling of bound variables and predicates arities. This is achieved via the use of De Bruijn indices and axioms distributing variables a la explicit substitutions. The latter proposition is eventually encoded by the following term, whose derivation using the decoding axioms is provided here as an example (see [Kir06] for more details): → → → → →

˙ x :: nil ∈ odd(1) ∪ even(1) ˙ ˙ ˙ x :: nil ∈ odd(1) ∨ x :: nil ∈ even(1) Odd(1[x :: nil]) ∨ x :: nil ∈ even(1) ˙ Odd(x) ∨ x :: nil ∈ even(1) ˙ Odd(x) ∨ Even(1[x :: nil]) Odd(x) ∨ Even(x)

This powerful mechanism enables the simulation of higher-order behaviour in proof assistants in a natural way. Indeed, decoding is only calculus, which therefore is well handled by both deduction modulo and superdeduction. Once again, a system mixing the two approaches would totally hide the encoding part to the user through deduction modulo while providing a natural way of expressing the induction reasoning via an extended deduction rule. 3.3 Equality Let us see now how superdeduction handles equality. Taken back to the previously discussed higher-order encoding, the Leibniz definition of equality is expressed as follows: eq : x = y → ∀p.(x :: nil ∈ p ⇒ y :: nil ∈ p) This leads to the derivation of the following new inference rules: eqL

Γ +R x :: nil ∈ p, Δ Γ, y :: nil ∈ p +R Δ Γ, x = y +R Δ

eqR

Γ, x :: nil ∈ p +R y :: nil ∈ p, Δ p ∈ FV(Γ, Δ) Γ +R x = y, Δ

Superdeduction at Work

149

The right rule is rather intuitive and is used to prove the reflexivity of equality in two proof steps: AX eqL

x :: nil ∈ p +R x :: nil ∈ p +R x = x ∀ R +R ∀x.x = x

The left rule requires a class term encoding a proposition and is typically used to prove extensionality of function symbols. For instance, given a function symbol f , let us prove that x = y ⇒ f (x) = f (y) for any x and y. The appropriate proposition to feed the axiom of Leibniz with would then be f (x) = f (α), parameterized by α. Let us translate this into a class term and prove the proposition: AX eqR

eqL

f (x) :: nil ∈ p +R f (x) :: nil ∈ p

AX

+R f (x) = f (x) ·· ·· +R x :: nil ∈ f (S(x))=1 ˙ x=y

f (x) = f (y) +R f (x) = f (y) ·· ··

y :: nil ∈ f (S(x))=1 ˙ +R f (x) = f (y) +R

f (x) = f (y)

The dots stands for decoding steps using axioms of [Kir06]. The S function symbol should be read as “shift” and is part of the explicit substitution mechanism. Thus, while Leibniz’ definition is adapted to proofs of equality metaproperties, simple notions like extensionality require some deduction steps. A natural use of superdeduction would then be to translate this theorem into an inference rule: fR

Γ +R x = y, Δ Γ +R f (x) = f (y), Δ

However, this goes beyond the scope of superdeduction since the proved proposition is not a proposition rewrite rule (i.e. an equivalence). A reasonable extension of superdeduction would be the creation of only-right inference rules to translate axioms of the shape ∀x.(P ⇒ ϕ). Nevertheless, the price to pay would be the loss of the cutelimination result. The question of extending the cut-elimination procedure to this case is still open. 3.4 Cut-Elimination as a Translation An interesting cut-reduction is the following. Let us consider the following proposition rewrite rule: I NC : ∀A.∀B.(A ⊆ B → ∀x.(x ∈ A ⇒ x ∈ B)) First of all we construct the proof π1 of +INC I NC depicted in Figure 6 (in fact for any theory Th, there is a proof of +Th Th by completeness of superdeduction). The proofterm associated with this proof is π1 = ForallR (a2 XForall R (a3 YAndR (a4 ν1 , a9 ν2 , a3 ), a2 ), a1 )

150

P. Brauner, C. Houtmann, and C. Kirchner

AX I NCL

x ∈ Y, x ∈ X +INC x ∈ Y

⇒R

x ∈ X +INC x ∈ Y, x ∈ X

X ⊆ Y, x ∈ X +INC x ∈ Y

⇒R ∀R

AX

X ⊆ Y +INC x ∈ X ⇒ x ∈ Y

X ⊆ Y +INC ∀x.(x ∈ X ⇒ x ∈ Y) +I NC

∧R

·· ·· ·· ·· ·· ·· ·· ·· ·· ·· ·

X ⊆ Y ⇒ (∀x.(x ∈ X ⇒ x ∈ Y)) AX ⇒L

x ∈ X +INC x ∈ Y, x ∈ X ∀L I NCR ⇒R

∀R ∀R

+I NC

+I NC

AX

x ∈ Y, x ∈ X +INC x ∈ Y

x ∈ X ⇒ x ∈ Y, x ∈ X +INC x ∈ Y ∀x.(x ∈ X ⇒ x ∈ Y), x ∈ X +INC x ∈ Y ∀x.(x ∈ X ⇒ x ∈ Y) +INC X ⊆ Y +INC (∀x.(x ∈ X ⇒ x ∈ Y)) ⇒ X ⊆ Y

X ⊆ Y ⇔ ∀x.(x ∈ X ⇒ x ∈ Y)

∀Y.(X ⊆ Y ⇔ ∀x.(x ∈ X ⇒ x ∈ Y))

+INC ∀X.∀Y.(X ⊆ Y ⇔ ∀x.(x ∈ X ⇒ x ∈ Y)) Fig. 6. The proof π1

with xImpR (

x1 a5 ForallR (a6 x2 a7 I NCL (

x3 Ax(x3 , a7 ), ν1 = ImpR (

a8 Ax(x2 , a8 ), x, x1 ), a6 ), a5 ), a4 ) and ν2 = ImpR (

x4 a

xx

5 a

x6 ImpL (

x7 Ax(x7 , a11 ), 10 I NCR ( 11 ForallL (

a

12 Ax(x5 , a12 ), x6 ), x, x4 ), a10 ), a9 ) Besides we propose the following proof of I NC A ⊆ A, denoted π2 , in raw classical sequent calculus. AX

. . . , x ∈ A A ⊆ A, x ∈ A . . . A ⊆ A, x ∈ A ⇒ x ∈ A AX ∀R ...,A ⊆ A A ⊆ A . . . A ⊆ A, ∀x.(x ∈ A ⇒ x ∈ A) ⇒L . . . , (∀x.(x ∈ A ⇒ x ∈ A)) ⇒ A ⊆ A A ⊆ A ∧L (A ⊆ A) ⇔ ∀x.(x ∈ A ⇒ x ∈ A) A ⊆ A ∀L ∀Y.(A ⊆ Y ) ⇔ ∀x.(x ∈ A ⇒ x ∈ Y ) A ⊆ A ∀L I NC A ⊆ A ⇒R

The proofterm associated with this proof is π2 = ForallL (

x9 ForallL (x

10 AndL (x 11 x 12 ν3 , x10 ), A, x9 ), A, x8 )

Superdeduction at Work

151

with ν3 = ImpL (x

13 Ax(x13 , a14 ), xImpR (x

a

15 ForallR (a

16 14 a

17 Ax(x14 , a17 ), a16 ), a15 ), x12 ) Now we wish to express the proof π2 in superdeduction. The corresponding proof denoted π3 is AX I NCR

x ∈ A +INC x ∈ A +INC A ⊆ A

We will now obtain it directly from π2 (and from π1 whose construction only depends on the axiom I NC). Let us consider the proofterm Cut(a1 π1 , x

8 π2 ) which represents the proof

C UT

π1 +I NC

I NC

+INC

π2 I NC A ⊆ A A⊆A

This proof can also be seen as the translation of the proof π2 in superdeduction: a cut is used to delete the axiom I NC from the context. Now it is interesting to understand that the elimination of this cut will actually propagate the superdeduction inference rules contained by π1 into the proof π2 and translate the (cut-free) proof of I NC A ⊆ A into a (cut-free) proof of +INC A ⊆ A replacing any use of the axiom I NC by a superdeduction rule. An elimination of this cut is depicted in Figure 7. Its result represents the proof π3 .

= excut +

Cut(a1 π1 , x 1 π2 ) Cut(a1 ForallR (a2 XForallR (a3 YAndR (a4 ν1 , a9 ν2 , a3 ), a2 ), a1 ), x8 ForallL (x 9 ForallL (x 10 AndL (x 11 x 12 ν3 , x10 ), A, x9 ), A, x8 ))

−→ Cut(a9 ν2 , x 12 ν3 ) 4 a = Cut(a9 ImpR (x 10 I NCR (. . . ), a9 ), x 12 ImpL (x 13 Ax(x13 , a14 ), a 15 ForallR (. . . ), x 12 )) excut −→ Cut(a x4 I NCR (. . . )), x 10 Cut(a 15 ForallR (. . . ), 13 Ax(x13 , a14 )) excut −→ Cut(a x4 I NCR (xx 5 a 15 ForallR (. . . ), 11 ForallL (. . . ), a14 )) excut −→ I NCR (xx 5 a 4 ForallL (. . . )), a14 ) 11 Cut(a 15 ForallR (. . . ), x excut −→ I NCR (x x5 a 6 ImpL (. . . )), a14 ) 11 Cut(a 16 ImpR (. . . ), x excut −→ I NCR (x x5 a 11 Cut(a 12 Ax(x5 , a12 ), x 7 Ax(x7 , a11 ))), a14 ) 14 Cut(a 17 Ax(x14 , a17 ), x excut +

−→

I NCR (x x5 a 11 Ax(x5 , a11 ), a14 ) Fig. 7. A cut-elimination of I NC

152

P. Brauner, C. Houtmann, and C. Kirchner

3.5 Crabbe’s Counterexample The (counter)example we consider now is known as Crabbe’s counterexample and consists in R : A → B ∧ (A ⇒ ⊥). The open-terms associated with it are: cImpR ( xb M2 , c), a) | a : B ∧ (A ⇒ ⊥) | = AndR (bM1 , y zImpL (y FalseL (y ), | x : B ∧ (A ⇒ ⊥) | = AndL ( aM, z), x) The reduction Cut( aAndR (bM1 , cImpR ( xb M2 , c), a), y zImpL (y FalseL (y ), aM, z), x)) x AndL ( cut ∗ −→ Cut(bM1 , yCut( aM, x M2 )) is replaced by

Cut( aRR (bM1 , x b M2 , a), x RL ( y aM, x)) → Cut(bM1 , yCut( aM, x M2 ))

with ad hoc conditions on freshly introduced variables. Let us define the two following terms. δ RL ( y aAx(x, a), x) Δ RR (bAx(z, b), x b δ, c) The following reduction does not terminate: Cut( cΔ, x δ) = Cut( cΔ, x RL ( y aAx(x, a), x)) y aAx(x, a), x) does not freshly introduce x RL ( → RL ( y aAx(x, a), x)[x := cΔ] y aAx(x, a)[x := cΔ], x)) = Cut( cΔ, x RL ( = Cut( cΔ, x RL ( y aΔ[c → a], a)) =α Cut( cΔ, x RL ( y cΔ, a)) = Cut( cRR (bAx(z, b), x b δ, c), x RL ( y cΔ, a)) → Cut( cCut(bAx(z, b), yΔ), x δ) Δ does not freshly introduces y → Cut( cΔ[y := bAx(z, b)], x δ) = Cut( cΔ, x δ) → ... This proposition rewrite rules thus breaks cut-elimination. It obviously does not satisfy Hypothesis 1. 3.6 A Convergent Presentation of Russel’s Paradox This interesting example has first been exposed for deduction modulo in [DW03]. It will be adapted here for superdeduction. Let us consider these two proposition rewrite rules. R1 : R ∈ R → ∀y.(y R ⇒ (R ∈ y ⇒ ⊥)) R2 : y z → ∀y.(x ∈ y ⇒ z ∈ y)

Superdeduction at Work

153

The associated inference rules are R1R

Γ, y R, R ∈ y Δ y∈ / FV(Γ, Δ) Γ R ∈ R, Δ

R1L

Γ R ∈ t, Δ Γ t R, Δ Γ, R ∈ R Δ

R2R

Γ, x ∈ t1 x ∈ t2 , Δ x∈ / FV(Γ, Δ) Γ t 1 t2 , Δ

R2L

Γ, t ∈ t2 Δ Γ t ∈ t1 , Δ Γ, t1 t2 Δ

Then we can prove ⊥. AX R2L

AX

R ∈ R, R ∈ y R ∈ R, ⊥ R ∈ y R ∈ y, R ∈ R, ⊥ y R, R ∈ y R ∈ R, ⊥ AX ·· R ∈ R, x ∈ R x ∈ R, ⊥ ·· AX R2L ·· R ∈ R R ∈ R, ⊥ R ∈ R R R, ⊥ ·· R1L R∈R⊥ ·· ·· · · · · · · · · · · · · · · · · · · · · · ··· ·· ·· · y R, R ∈ y, R ∈ R ⊥ ·· C UT · ·· y R, R ∈ y ⊥ ·· R1R R ∈ R, ⊥ · C UT ⊥

The deduction system is not consistent and since there is no cut-free proof of ⊥, strong normalisation of the cut-reduction does not hold. The set of proposition rewrite rules {R1 , R2 } does not satisfy the hypothesis of Theorem 2 because of the constant R in R ∈ R which also plays a central role in the proof of ⊥. 3.7 Lemuridæ All these properties led us to develop a proof assistant based on the super sequent calculus: lemuridæ. It features extended deduction rules derivation with focussing, rewriting on first-order terms, proof building with the associated superdeduction system, as well as some basic automatic tactics. It is implemented with the T OM [MR06] language, which provides powerful (associative) rewriting capabilities and strategic programmation on top of JAVA. The choice of the T OM language has several beneficial consequences. First of all, the expressiveness of the language allows for clean and short code. This is in particular the case of the micro proofchecker, whose patterns faithfully translate deduction rules of sequent calculus. Thus, the proofchecker is only one hundred lines long and it is therefore more realistic to convince everyone that it is actually sound. The other main contribution of T OM to lemuridæ is the expression of tacticals by strategies. The T OM strategy language is directly inspired from early research on E LAN [VB98] and ρ-calculus and allows to compose basic strategies to express complex programs using strategies combinators. In this formalism, a naive proof search tactical is simply expressed by topdown(elim), where topdown is a “call-by-name” strategy and elim has the usual semantics of the corresponding command.

154

P. Brauner, C. Houtmann, and C. Kirchner

4 Full Proofs of the Principles In this section we provide the full proofs of Theorem 2. Let us prove first the following simple result. Lemma 2. For some well-typed open-term C Γ Δ whose open leaves are Γi Δi for 1 i nC , for some σ covering C, if for all 1 i nC , Mi σΓi σΔi is a well-typed term, then σC[M1 , . . . , MnC ] σΓ σΔ is a well-typed term. Proof. We proceed by induction on the context C. – If it is Γ Δ, typed by Γ Δ, then its type inference derivation is the single leaf Γ Δ and nC = 1. As by hypothesis M1 σΓ σΔ is well-typed, and as by definition σC[M1 ] = M1 , σC[M1 ] σΓ σΔ is well-typed. – If it is Ax(x, a), typed by Γ , x : ϕ a : ϕ, Δ . then its type inference derivation has no leaf since it is AX

Ax(x, a) Γ , x : ϕ a : ϕ, Δ

Then C = σC[] is a term and σC[] σΓ σΔ is a well-typed term. cC2 , a), the type inference is – If it is AndR (bC1 ,

∧R

... ... C1 Γ b : ϕ1 , Δ C2 Γ c : ϕ2 , Δ AndR (bC1 , cC2 , a) Γ a : ϕ1 ∧ ϕ2 , Δ

By induction hypothesis, σC1 [M1 , . . . , MnC1 ] σΓ, b : σϕ1 , σΔ and

σC2 [MnC1 +1 , . . . , MnC1 +nC2 ] σΓ, c : σϕ2 , σΔ

are well-typed. Then σC[M1 , . . . , MnC ] σΓ a : σϕ1 ∧ σϕ2 , σΔ is well-typed. – If it is ExistsR ( aC1 , α, b), the type inference is

∃R

... C1 Γ a : ϕ[x := α], Δ ExistsR ( aC1 , α, b) Γ b : ∃x.ϕ, Δ

By induction hypothesis, σC1 [M1 , . . . , MnC ] σΓ a : (σϕ)[x := σα], σΔ

Superdeduction at Work

155

is well-typed and then σC[M1 , . . . , MnC ] σΓ b : ∃x.σϕ, σΔ is well-typed. x xC1 , y), the type inference is – If it is ExistsL ( ... C1 Γ, x : ϕ Δ ∃L x∈ / FV(Γ, Δ ) ExistsL ( x xC1 , y) Γ, y : ∃x.ϕ Δ By induction hypothesis, σC1 [M1 , . . . , MnC ] σΓ, x : σϕ σΔ is well-typed, and then σC[M1 , . . . , MnC ] σΓ, y : ∃x.σϕ σΔ is well-typed. – other cases are similar. Subject reduction is implied by Lemmas 2 and 1. excut∗

Lemma 3 (Subject Reduction). If M −→ M and M Γ Δ is well-typed, then M Γ Δ is well-typed. excut

Proof. By inspection of the rules defining −→.

prop

We define a rewrite system denoted −→ on propositions by turning each proposition rewrite rule into a rewrite rule in the standard way (see for example [DHK03]). We term define a rewrite system denoted −→ on extended proof-terms as follows. It contains for each R : P → ϕ the rewrite rule ⎛ ⎞

term

i . . . x

i ai . . . a i M σRR⎝x1 . . . xp , x i , α1 . . . αq , a⎠−→ σ| a : ϕ |[M1 , . . . , Mn ] pi 1 qi 1 1in

where σ is a substitution over placeholder-terms covering | a : ϕ | (here the bound names and conames of this later open-term are supposed different from the free and bound names and conames of RR (. . . )) and the rewrite rule ⎛

σRL⎝y1 . . . yr , y1j . . . yrjj bj1 . . . bjsj Nj

⎞ term , β1 . . . βs , x⎠−→ σ| x : ϕ |[N1 , . . . , Nm ]

1jm

where σ is a substitution over placeholder-terms covering | x : ϕ | (here the bound names and conames of this later open-term are supposed different from the free and bound names and conames of RL (. . . )).

156

P. Brauner, C. Houtmann, and C. Kirchner term

term

As −→ is orthogonal, it is confluent. Besides if −→ is confluent and weakly normalising, then the unique normal form of an extended term M is denoted M ↓t . Similarly prop if −→ is confluent and weakly normalising, then the unique normal form of a formula ϕ is denoted ϕ ↓p . This notation is extended to contexts and sequents. It is also extended to open-terms, since they also contain sequents through the Γ Δ constructor. excut Let us prove now that −→ is strongly normalising on well-typed extended terms under the following hypothesis. prop

Hypothesis 1. For a set of proposition rewrite rules R, the rewrite relation −→ associated with R is weakly normalising and confluent and for each of its rule R : P → ϕ: – P contains only first-order variables (no function or constant); – F V(ϕ) ⊆ F V(P ). The second hypothesis restricts the use of first-order constants and functions in particular to avoid counterexamples such as the presentation of Russel’s paradox from [DW03] and presented in Section 3 for which the set of proposition rewrite rules terminates but the cut-elimination does not. Now let us begin our strong normalisation proof with the following lemmas. First, if term ∗ no proper subterm of M introduces some name or coname and if M −→ M , then no proper subterm of M introduces this name of coname. This remark allows to prove the following lemma. term

Lemma 4. If M −→ M then M freshly introduces some name or coname is equivalent to M freshly introduces this name of coname. term

By definition of −→ with respect to substitutions over first-order variables, the following lemma is straightforward. term

term

Lemma 5. If M −→ M , then for all substitution [x := t], M [x := t] −→ M [x := t]. term ∗ This result extends obviously to −→ . This allows to prove the following corollary. term

Corollary 1. If −→ is weakly normalising, for all M and [x := t], (M [x := t]) ↓t = (M ↓t )[x := t]. term ∗

term ∗

Proof. By Lemma 5 and since M −→ M ↓t , then M [x := t] −→ (M ↓t )[x := t]. term Moreover it is to be noticed that by definition of −→ and for all term N , N contains a term redex for −→ implies that N [x := t] contains a redex. Therefore (M ↓t )[x := t] is a term normal form for −→ and it is (M [x := t]) ↓t . We supposed that in any proposition rewrite rule R : P → ϕ, P (which is a predicate) only contains first-order variables, and no first-order constant or function. Thus it implies the following lemma. prop

Lemma 6. Let ϕ and ϕ be some first-order formulæ such that ϕ −→ ϕ . Let x be some prop first-order variable and t be some first-order term. Then ϕ[x := t] −→ ϕ [x := t]

Superdeduction at Work

157

prop

Proof. We first suppose that the reduction ϕ −→ ϕ is done at the head of ϕ. If the reduction takes place inside a context, we proceed by induction on this context. prop ∗

This result is extended to −→ in the obvious way. Besides, it implies the following corollary. Corollary 2. Let ϕ be some first-order formula. Let x be some first-order variable and t be some first-order term. Then (ϕ[x := t]) ↓p = ϕ ↓p [x := t]. prop ∗

prop ∗

Proof. As ϕ −→ ϕ ↓p , by Lemma 6, ϕ[x := t] −→ ϕ ↓p [x := t]. If this later formula contains some redex, this redex is an instance of P (x1 , . . . , xn ). Then ϕ ↓p also contains an instance of P (x1 , . . . , xn ). This is a contradiction to the fact that ϕ ↓p prop is a normal form for −→. Thus ϕ ↓p [x := t] = (ϕ[x := t]) ↓p . We can also prove a result similar to Corollary 2 on placeholder-terms substitutions. Lemma 7. Let ϕ be some first-order formula. Let σ be some placeholder-terms substitution. Then (σϕ) ↓p = σ(ϕ ↓p ). Proof. Similar to Corollary 2, with a lemma similar to Lemma 6.

The last hypothesis we did on the set of proposition rewrite rule is that for each R : P → ϕ, we have F V(ϕ) ⊆ F V(P ). It allows to prove the following lemma. prop

Lemma 8. Let ϕ1 and ϕ2 be some formulæ such that ϕ1 −→ ϕ2 . Then F V(ϕ2 ) ⊆ F V(ϕ1 ). prop

Proof. – If the reduction ϕ1 −→ ϕ2 takes place at the head of ϕ1 . Then for some R : P (x1 , . . . , xp ) → ϕ, ϕ1 is P (t1 , . . . , tp ) where the ti are first-order terms. Then ϕ2 is ϕ[(xi := ti )1ip ]. As the free variables of ϕ are by hypothesis included in {x1 , . . . , xp }, the free variables of ϕ2 are included in F V(t1 )∪· · · ∪F V(tp ), which is the set F V(ϕ1 ). prop – If the reduction ϕ1 −→ ϕ2 takes place inside a context, we proceed by induction on this context. prop ∗

This result is extended to −→ in the obvious way. Lemma 9. Any open type inference derivation of C Γ Δ with open leaves Γi Δi for 1 i nC may be turned into an open type inference derivation of C ↓p Γ ↓p Δ ↓p with premises Γi ↓p Δi ↓p . Proof. By induction on the open type inference derivation. – One of the base cases is for instance the axiom case : if C = Ax(x, a), and C Γ , x : ϕ a : ϕ, Δ well-typed (by the axiom rule), then it is straightforward that C ↓p Γ ↓p , x : ϕ ↓p a : ϕ ↓p , Δ ↓p is well-typed.

158

P. Brauner, C. Houtmann, and C. Kirchner

– Let us treat the case of an open leaf : if C = Γ Δ, then C ↓p = Γ ↓p Δ ↓p is also well-typed. ( Γ ↓p Δ ↓p ) Γ ↓p Δ ↓p – Let us treat the case of ∧R . In this case C is AndR (bC1 , cC2 , a) and the type inference derivation has the following form ( Γi Δi )i∈{1,...,nC1 } ∧R

( Γi Δi )i∈{nC1 +1,...,nC }

... ... C1 Γ b : ϕ1 , Δ C2 Γ c : ϕ2 , Δ C Γ a : ϕ1 ∧ ϕ2 , Δ

Then by induction hypothesis on the open type inference derivations of C1 and C2 , we obtain open type inference derivations of C1 ↓p Γ ↓p b : ϕ1 ↓p , Δ ↓p and of C2 ↓p Γ ↓p c : ϕ2 ↓p , Δ ↓p with open leaves Γi ↓p Δi ↓p . Finally as (ϕ1 ∧ ϕ2 ) ↓p = ϕ1 ↓p ∧ϕ2 ↓p and C ↓p = AndR (bC1 ↓p , cC2 ↓p , a) this gives using the rule ∧R an open type inference derivation of C ↓p Γ ↓p Δ ↓p . – Let us treat the case of ∃R . In this case C is ExistsR (bC1 , α, a) and the type inference derivation has the following form.

∃R

( Γi Δi )1inC ... C1 Γ b : ϕ[x := α], Δ C Γ a : ∃x.ϕ, Δ

Then by induction hypothesis on the open type inference derivations of C1 , we obtain an open type derivation of C1 ↓p Γ ↓p (ϕ[x := α]) ↓p , Δ ↓p with open leaves Γi ↓p Δi ↓p . By Corollary 2 (ϕ[x := α]) ↓p is equal to ϕ ↓p [x := α]. Finally as (∃x.ϕ) ↓p = ∃x.(ϕ) ↓p and as C ↓p = ExistsR (bC1 , α, a) ↓p , this give an open type inference derivation of C ↓p Γ ↓p Δ ↓p . – Let us treat the case of ∃L . In this case C is ExistsL ( y xC1 , x) and the type inference derivation has the following form. ( Γi Δi )1inC ... C1 Γ , y : ϕ Δ ∃L x∈ / FV(Γ , Δ) ExistsL ( y xC1 , x) Γ , x : ∃x.ϕ Δ Then by induction hypothesis on the open type inference derivation of C1 , we obtain an open type inference derivation of C1 ↓p Γ ↓p , y : ϕ ↓p Δ ↓p with open leaves Γi ↓p Δi ↓p . First of all by Lemma 8 and as x ∈ / F V(Γ , Δ), x p p p p is not in F V(Γ ↓ , Δ ↓ ). Furthermore (∃x.ϕ) ↓ = ∃x.(ϕ) ↓ . Since C ↓p = y xC1 ↓p , x), we can build an open type inference derivation of C ↓p ExistsL ( p Γ ↓ Δ ↓p . – other cases are similar.

Superdeduction at Work

159

Lemma 10. If M Γ Δ is well-typed, then there exists M such that M Γ ↓p term term! Δ ↓p is well-typed. Besides M −→ M and M is a normal form, denoted M −→ M . Proof. By induction on the type inference derivation of M Γ Δ. – If the bottom rule of the derivation is for instance the Ax rule. M is Ax(x, a) and the derivation is AX

Ax(x, a) Γ , x : ϕ a : ϕ, Δ

Then we can build the following derivation. AX

Ax(x, a) Γ ↓p , x : ϕ ↓p a : ϕ ↓p , Δ ↓p term!

Finally we can check that M −→ Ax(x, a). – If the bottom rule of the derivation is for instance the ∧R rule. M is AndR (bM1 , cM2 , c) and the derivation is

∧R

... ... M1 Γ b : ϕ1 , Δ M2 Γ c : ϕ2 , Δ M Γ a : ϕ1 ∧ ϕ2 , Δ

By induction hypothesis there exists M1 and M2 such that M1 Γ ↓p b : ϕ1 ↓p , Δ ↓p and M2 Γ ↓p c : ϕ2 ↓p , Δ ↓p are well-typed. Then we can build the following derivation.

∧R

M1

... ... p p p Γ ↓ b : ϕ1 ↓ , Δ ↓ M2 Γ ↓ c : ϕ2 ↓p , Δ ↓p M Γ ↓p a : ϕ1 ↓p ∧ϕ2 ↓p , Δ ↓p p

where M stands for AndR (bM1 , cM2 , c). Finally as ϕ1 ↓p ∧ϕ2 ↓p = (ϕ ∧ ϕ2 ) ↓p we have found M such that M Γ ↓p Δ ↓p is well-typed and such that term! M −→ M . – If the bottom rule of the derivation is for instance ∃R , M is ExistsR (bM1 , t, a) and the derivation is ... M1 Γ a : ϕ[x := t], Δ ∃R M Γ a : ∃x.ϕ, Δ By induction hypothesis there exists M1 such that M1 Γ ↓p a : ϕ[x := t] ↓p , Δ ↓p is well-typed. By Corollary 2, ϕ[x := t] ↓p = ϕ ↓p [x := t] and then we can build the derivation.

∃R

... Γ ↓ a : ϕ ↓p [x := t], Δ ↓p M Γ ↓p a : ∃x.ϕ ↓p , Δ ↓p

M1

p

where M stands for ExistsR (bM1 , t, a). Finally as (∃x.ϕ) ↓p = ∃x.ϕ ↓p , we have term!

found M such that M Γ ↓p Δ ↓p is well-typed and M −→ M .

160

P. Brauner, C. Houtmann, and C. Kirchner

– If the bottom rule of the derivation is for instance ∃L , M is ExistsL ( y xM1 , x) and the derivation is ... M1 Γ , y : ϕ Δ ∃L x∈ / FV(Γ , Δ) M Γ , x : ∃x.ϕ Δ By induction hypothesis there exists M1 such that M1 Γ ↓p , x : ϕ ↓p Δ ↓p is well-typed. As x ∈ / F V(Γ , Δ) and by Lemma 8, x ∈ / F V(Γ ↓p , Δ ↓p ), we can build the following derivation. ... M1 Γ ↓p , y : ϕ ↓p Δ ↓p ∃L x∈ / FV(Γ ↓p , Δ ↓p ) M Γ ↓p , x : ∃x.ϕ ↓p Δ ↓p where M stands for ExistsL ( y xM1 , x). Finally as ∃x.ϕ ↓p = ∃x.ϕ ↓p , we have term!

found M such as M Γ ↓p Δ ↓p is well-typed and M −→ M . – If the bottom rule of the derivation is not an extended rule, other cases are similar. – If the bottom rule of the derivation is an extended rule, say RR for R : P → ϕ, it has the form (Mi Γi Δi )i RR C RR (. . . , (. . . Mi )i , . . . , a) Γ a : P, Δ Let us denote C = | a : ϕ |. By induction hypothesis there exists M1 , . . . , Mn C term!

such that for all i, Mi Γi ↓p Δi ↓p is well-typed and Mi −→ Mi . Besides by Lemma 1, there exists a substitution for placeholder-terms σ and an open type inference derivation whose open leaves are the Γi Δi with σΓi = Γi and σΔi = Δi for all i and whose conclusion is C Γ a : ϕ, Δ . By Lemma 9, this open type inference derivation can be turned into one with open leaves Γi ↓p Δi ↓p and with conclusion C ↓p Γ ↓p a : ϕ ↓p , Δ ↓p . Let us notice that for all i and by Lemma 7, Γi ↓p = (σΓi ) ↓p = σ(Γi ↓p ) and Δi ↓p = (σΔi ) ↓p = σ(Δi ↓p ). Thus by Lemma 2, σC ↓p [(Mi )i ] σ(Γ ↓p ) a : σ(ϕ ↓p ), σ(Δ ↓p ) is well-typed. Since σΓ ↓p = Γ ↓p , σϕ ↓p = ϕ ↓p and σΔ ↓p = Δ ↓p (Γ , ϕ and Δ appear in a derivation in the super sequent calculus and therefore do not contain placeholder-terms !) and since P ↓p = ϕ ↓p , this is a type inference of term! σC ↓p [(Mi )i ] Γ ↓p a : P ↓p , Δ ↓p . Finally as for all i, Mi −→ Mi , then M = RR (. . . , (. . . Mi )i , . . . , a) term −→ σC[(Mi )i ] = σC ↓p [(Mi )i ] term −→ σC ↓p [(Mi )i ] term!

As this later term is a normal form, M −→ σC ↓p [(Mi )i ]. term

Corollary 3. −→ is weakly normalising on well-typed extended terms. Moreover for all M Γ Δ well-typed, M ↓t Γ ↓p Δ ↓p is well-typed in Urban’s type system.

Superdeduction at Work

161

Proof. From Lemma 10. + t cut

excut

Lemma 11. If M −→ M , then M ↓ −→ M ↓t . excut

Proof. Let us suppose first that the reduction M −→ M is done at the head of M . We can distinguish two cases. cut

cut

– if the reduction is a −→ reduction, then M is a redex for the −→ reduction. Let us consider for instance the ∧ case. Thus M has the form Cut( aAndR (bM1 , cM2 , a), x AndL ( y zN, x)) cM2 , a) and AndL ( y zN, x) freshly introduces a and x and M where AndR (bM1 , may have the form Cut(bM1 , yCut( cM2 , zN )) (case 1) or the form

Cut( cM2 , zCut(bM1 , yN )) (case 2)

Then M ↓t is cM2 ↓t , a), x AndL ( y zN ↓t , x)) Cut( aAndR (bM1 ↓t , cM2 ↓t , a) and AndL ( y zN ↓t , x) freshly introduces a and x where AndR (bM1 ↓t , (Lemma 4) and reduces in one step into cM2 ↓t , zN ↓t )) Cut(bM1 ↓t , yCut( and also into

Cut( cM2 ↓t , zCut(bM1 ↓t , yN ↓t ))

The first is M ↓t in case 1, the second is M ↓t in case 2. So in both cases, cut +

M ↓t −→ M ↓t . cut – If the reduction is a −→ reduction, let us consider for instance the ∃ case. Thus M has the form ExistsL ( y xN, x)) Cut( aExistsR (bM, t, a), x where ExistsR (bM, t, a) freshly introduces a and M is Cut(bM, yN [x := t]) Then M ↓t is Cut( aExistsR (bM ↓t , t, a), x ExistsL ( y xN ↓t , x)) where ExistsR (bM ↓t , t, a) freshly introduces a (Lemma 4) and reduces in one step into Cut(bM, yN ↓t [x := t]) By Corollary 1, N ↓t [x := t] = (N [x := t]) ↓t and we obtain that the later one-step reduct of M ↓t is in fact M ↓t .

162

P. Brauner, C. Houtmann, and C. Kirchner cut

– If the reduction is a −→ reduction, let us consider the case where M is Cut( aM 1 , x M2 ) with M1 does not freshly introduce a (the case where M2 does not freshly introduce x is symmetrical) and M is M1 [a := x M2 ] Then M ↓t is M2 ↓t ) Cut( aM 1 ↓ t , x and since M1 ↓t does not freshly introduce a (Lemma 4), we deduce that it reduces to M2 ↓t ] M1 ↓t [a := x term

As this later is a normal form and a reduct of M for −→, it is M ↓t . cut – Other cases of −→ reductions are similar. excut – If the reduction is a −→ reduction, then M is of the form Cut( aRR (. . . , (. . . Mi )i , . . . , a), x RL (. . . , (. . . Nj )j , . . . , x)) with R : P → ϕ. Let us denote CR and CL respectively | a : ϕ | and | x : ϕ |. term Thus we may write the following reduction in −→. RL ((. . . Nj )j , x)) M = Cut( aRR ((. . . Mi )i , a), x term −→ Cut( aσCR [(Mi )i ], x σ CL [(Nj )j ]) term −→ Cut( aσCR [(Mi ↓t )i ], x σ CL [(Nj ↓t )j ]) where σ and σ are ad hoc placeholder-term substitutions. As this later term is a term excut normal form for −→, it is in fact M ↓t . Besides by definition of −→, there exists cut +

an open-term C such that Cut( aCR , x CL ) −→ C with M = σ C[M1 , . . . , Np ], cut +

and thus M ↓t = σ C[M1 ↓t , . . . , Np ↓t ]. As Cut( aCR , x CL ) −→

C, we de-

+ t cut

duce finally that M ↓ −→ M ↓t . excut

Now let us suppose that the reduction M −→ M is done under some context. We reason by induction on this context. We just treated the case of an empty context. – Let us consider now for instance the case of RR . M is of the form RR (. . . , (. . . , Mi )i , . . . , a) and M is RR (. . . , (. . . , Mi )i , . . . , a) with some k such cut +

excut

that Mk −→ Mk and for all i = k, Mi = Mi . By induction hypothesis, Mk ↓t −→ Mk ↓t and then M ↓t = σC[(Mi ↓t )i ] cut +

−→ σC[(Mi ↓t )i ] = M ↓t

Superdeduction at Work

163

– Let us consider now for instance the case of AndR . M is of the form AndR (bM1 , cM2 , a) and M is of the form AndR (bM1 , cM2 , a) with some i in excut {1, 2} such that Mi −→ Mi and Mk = Mk for k = i. By induction hypothesis, cut +

Mi ↓t −→ Mi ↓t and thus M ↓t

AndR (bM1 ↓t , cM2 ↓t , a) −→ AndR (bM1 ↓t , cM2 ↓t , a) t = M ↓ =

cut +

– Let us consider now for instance the case ExistsR . M is of the form excut ExistsR (bM1 , t, a) and M is of the form ExistsR (bM1 , t, a) with M1 −→ M1 . By cut +

induction hypothesis, M1 ↓t −→ M1 ↓t and thus M ↓t

ExistsR (bM1 ↓t , t, a) −→ ExistsR (bM1 ↓t , t, a) = M ↓t =

cut +

– Let us consider now for instance the case ExistsL . M is of the form excut ExistsL ( y xM1 , x) and M is ExistsL ( y xM1 , x) with M1 −→ M1 . By induction cut +

hypothesis, M1 ↓t −→ M1 ↓t and thus M ↓t = ExistsL ( y xM1 ↓t , x) cut −→ ExistsL ( y xM1 ↓t , x) t = M ↓ – Other cases are similar. Now we can prove the main result: Theorem 2 (Strong Normalisation). If the set of proposition rewrite rules satisfies excut Hypothesis 1, then −→ is strongly normalising on well-typed extended terms. prop

Proof. Let us suppose that −→ is convergent. Let M Γ Δ be some well-typed extended term. Let us suppose that there exists an infinite reduction excut

excut

M = M0 −→ M1 −→ M2 . . . term

First by Corollary 3, −→ is weakly normalising and M ↓t Γ ↓p Δ ↓p . Besides by Lemma 11, there is an infinite reduction cut +

cut +

M ↓t = M0 ↓t −→ M1 ↓t −→ M2 ↓t . . . cut

This is impossible since M ↓t is well-typed in Urban’s calculus and −→ is strongly normalising on well-typed terms [Urb00].

164

P. Brauner, C. Houtmann, and C. Kirchner

5 Conclusion We have motivated and presented superdeduction, a powerful systematic way of extending deduction systems with rules derived from an axiomatic theory. First, we have presented its application to classical sequent calculus along with its properties. After having exhibited a proof-term language associated with this deduction system along with a cut-elimination procedure, we have shown in details its strong normalisation under non-trivial hypothesis, therefore ensuring the consistency of a large class of theories, as well as of the corresponding instances of the system. We have shown on significative examples including higher-order logic, induction and equality why superdeduction could be a grounding framework for a new generation of interactive proof environments. A prototype of this framework, lemuridæ, has been presented and can be actually downloaded. The very promising results obtained when using lemuridæ, first in term of proof discovery agility and second in the close relationship between human constructed proofs and superdeduction ones, are all very encouraging and trigger the further development of the concepts and implementation. This leads to new questions, since, as seen in Section 3, the behavior of superdeduction systems with propositions considered modulo a congruence is important to study now in details. This will for instance allow building proofs modulo the symmetry of equality. Another promising point of further research is program extraction from lemuridæ proof-terms along with a computational interpretation of extended deduction rules. We anticipate the extracted programs to have modular structures inherited from the superdeduction proof. The link, studied in [BDW07], between supernatural deduction (e.g. superdeduction applied to natural deduction) and natural deduction modulo, shows the equivalence between strong normalisation of cut elimination in supernatural deduction and in natural deduction modulo for the implicational fragment of predicate logic. The links between cut elimination in superdeduction and deduction modulo for the sequent calculus have still to be worked out. However, we already can import theories expressed by proposition rewrite rules for deduction modulo to super sequent calculus systems. This is in particular the case of Peano’s arithmetic [DW05], but also of Zermelo-Frænkel axiomatization of set theory [DM07]. Finally, let us stress out the recent encoding of pure types systems in λΠ-calculus modulo [CD07]. Indeed, since recent works by G. Burel show that the λΠ-calculus can be naturally encoded in the super sequent calculus, this globally confirms the legitimacy of superdeduction as a foundation for high-level proof assistants. It opens also new questions on the global architecture of proof systems as well as on the interaction with users, either humans or programs. Acknowledgments. Many thanks to Benjamin Wack for inspiring discussions and his seminal work on this topics, to Horatiu Cirstea for his detailed and crisp comments on previous version this work, to Dan Dougherty for helpful discussions, to the Modulo meetings and the Protheo team for many interactions.

Superdeduction at Work

165

References [Alv00] [AM99]

[And92] [And01] [BDW07]

[BHdN02] [BHK07] [BJO02] [Bra06] [Bur07]

[CD07] [CH00]

[CK01] [CLW03]

[DHK03] [DM07] [Dow97]

[DW03] [DW05] [Her95] [HOL93]

Alvarado, C.: Reflection for rewriting in the calculus of inductive constructions. In: Proceedings of TYPES 2000, Durham, United Kingdom (December 2000) Andreoli, J.-M., Maieli, R.: Focusing and proof-nets in linear and non-commutative logic. In: Ganzinger, H., McAllester, D., Voronkov, A. (eds.) LPAR 1999. LNCS, vol. 1705, pp. 321–336. Springer, Heidelberg (1999) Andreoli, J.-M.: Logic programming with focusing proofs in linear logic. Journal of Logic and Computation 2(3), 297–347 (1992) Andreoli, J.-M.: Focussing and proof construction. Annals Pure Applied Logic 107(1-3), 131–163 (2001) Brauner, P., Dowek, G., Wack, B.: Normalization in supernatural deduction and in deduction modulo (2007) Available at http://hal.inria.fr/inria-00141720 Bezem, M., Hendriks, D., de Nivelle, H.: Automated proof construction in type theory using resolution. Journal of Automated Reasoning 29(3-4), 253–275 (2002) Brauner, P., Houtmann, C., Kirchner, C.: Principles of superdeduction. In: Proceedings of LICS (July 2007) Blanqui, F., Jouannaud, J.-P., Okada, M.: Inductive Data Type Systems. Theoretical Computer Science 272(1-2), 41–68 (2002) Brauner, P.: Un calcul des séquents extensible. Master’s thesis, Université Henri Poincaré – Nancy 1 (2006) Burel, G.: Unbounded proof-length speed-up in deduction modulo. Technical report, INRIA Lorraine (2007) Available at http://hal.inria.fr/inria-00138195 Cousineau, D., Dowek, G.: Embedding pure type systems in the lambda-pi-calculus modulo. In: TLCA 2007. LNCS, vol. 4583. Springer, Heidelberg (To appear, 2007) Curien, P.-L., Herbelin, H.: The duality of computation. In: ICFP ’00: Proceedings of the fifth ACM SIGPLAN international conference on Functional programming, pp. 233–243. ACM Press, New York, NY, USA (2000) Cirstea, H., Kirchner, C.: The rewriting calculus — Part I and II. Logic Journal of the Interest Group in Pure. and Applied Logics 9(3), 427–498 (2001) Cirstea, H., Liquori, L., Wack, B.: Rewriting calculus with fixpoints: Untyped and first-order systems. In: Berardi, S., Coppo, M., Damiani, F. (eds.) TYPES 2003. LNCS, vol. 3085, Springer, Heidelberg (2004) Dowek, G., Hardin, T., Kirchner, C.: Theorem proving modulo. Journal of Automated Reasoning 31(1), 33–72 (2003) Dowek, G., Miquel, A.: Cut elimination for Zermelo’s set theory. Available on author’s web page (2007) Dowek, G.: Proof normalization for a first-order formulation of higher-order logic. In: Gunter, E.L., Felty, A.P. (eds.) TPHOLs 1997. LNCS, vol. 1275, pp. 105–119. Springer, Heidelberg (1997) Dowek, G., Werner, B.: Proof normalization modulo. Journal of Symbolic Logic 68(4), 1289–1316 (2003) Dowek, G., Werner, B.: Arithmetic as a theory modulo. In: Giesl, J. (ed.) RTA 2005. LNCS, vol. 3467, pp. 423–437. Springer, Heidelberg (2005) Herbelin, H.: Séquents qu’on calcule. PhD thesis, Université Paris 7 (January 1995) University of Cambridge, DSTO, SRI Internatioal. Description of the HOL-System (1993)

166

P. Brauner, C. Houtmann, and C. Kirchner

[Hou06] [Jou05]

[Kir06] [KRRT06]

[Len03] [MQP06] [MR06] [NKK02] [ORS92]

[Pau94] [Pra65] [Pre05]

[Rud92] [The04] [UB01] [Urb00] [Urb01]

[VB98]

[vBLL05]

[Wac05] [Wad03]

Houtmann, C.: Cohérence de la déduction surnaturelle. Master’s thesis, École Normale Supérieure de Cachan (2006) Jouannaud, J.-P.: Higher-order rewriting: Framework, confluence and termination. In: Middeldorp, A., van Oostrom, V., van Raamsdonk, F., de Vrijer, R.C. (eds.) Processes, Terms and Cycles, pp. 224–250 (2005) Kirchner, F.: A finite first-order theory of classes (2006) http://www.lix.polytechnique.fr/Labo/Florent.Kirchner/ Kirchner, H., Ranise, S., Ringeissen, C., Tran, D.-K.: Automatic combinability of rewriting-based satisfiability procedures. In: Hermann, M., Voronkov, A. (eds.) LPAR 2006. LNCS (LNAI), vol. 4246, pp. 542–556. Springer, Heidelberg (2006) Lengrand, S.: Call-by-value, call-by-name, and strong normalization for the classical sequent calculus. Electronic Notes in Theoretical Computer Science, vol. 86(4) (2003) Meng, J., Quigley, C., Paulson, L.C.: Automation for interactive proof: First prototype. Information and Computation 204(10), 1575–1596 (2006) Moreau, P.-E., Reilles, A.: The tom home page (2006) http://tom.loria.fr Nguyen, Q.-H., Kirchner, C., Kirchner, H.: External rewriting for skeptical proof assistants. Journal of Automated Reasoning 29(3-4), 309–336 (2002) Owre, S., Rushby, J.M., Shankar, N.: PVS: A prototype verification system. In: Kapur, D. (ed.) Automated Deduction - CADE-11. LNCS, vol. 607, pp. 748–752. Springer, Heidelberg (1992) Paulson, L.: Isabelle: A Generic Theorem Prover. LNCS, vol. 828. Springer, Heidelberg (1994) Prawitz, D.: Natural Deduction. A Proof-Theoretical Study, vol. 3 of Stockholm Studies in Philosophy. Almqvist & Wiksell, Stockholm (1965) Prevosto, V.: Certified mathematical hierarchies: the focal system. In: Coquand, T., Lombardi, H., Roy, M.-F. (eds.) Mathematics, Algorithms, Proofs, number 05021 in Dagstuhl Seminar Proceedings, Dagstuhl, Germany, Internationales Begegnungsund Forschungszentrum (IBFI), Schloss Dagstuhl, Germany (2005) Rudnicki, P.: An overview of the Mizar project. Notes to a talk at the workshop on Types for Proofs and Programs (June 1992) The Coq development team. The Coq proof assistant reference manual. LogiCal Project, Version 8.0 (2004) Urban, C., Bierman, G.M.: Strong normalisation of cut-elimination in classical logic. Fundam. Inform. 45(1-2), 123–155 (2001) Urban, C.: Classical Logic and Computation. PhD thesis, University of Cambridge, (October 2000) Urban, C.: Strong normalisation for a gentzen-like cut-elimination procedure. In: Abramsky, S. (ed.) TLCA 2001. LNCS, vol. 2044, pp. 415–430. Springer, Heidelberg (2001) Visser, E., Benaissa, Z.-e.-A.: A core language for rewriting. In: Kirchner, C., Kirchner, H. (eds.) WRLA, Pont-à-Mousson, France, September 1998. Electronic Notes in Theoretical Computer Science, vol. 15, Elsevier, North-Holland (1998) van Bakel, S., Lengrand, S., Lescanne, P.: The language X : circuits, computations and classical logic. In: van Bakel, S., Lengrand, S., Lescanne, P. (eds.) ICTCS’05. Proceedings of Ninth Italian Conference on Theoretical Computer Science. LNCS, vol. 3701, pp. 81–96. Springer, Heidelberg (2005) Wack, B.: Typage et déduction dans le calcul de réécriture. PhD thesis, Université Henri Poincaré, Nancy 1 (October 2005) Wadler, P.: Call-by-value is dual to call-by-name. In: ICFP ’03: Proceedings of the eighth ACM SIGPLAN international conference on Functional programming, September 2003, pp. 189–201. ACM Press, New York (2003)

Remarks on Semantic Completeness for Proof-Terms with Laird’s Dual Aﬃne/Intuitionistic λ-Calculus Mitsuhiro Okada and Ryo Takemura Department of Philosophy, Keio University, 2-15-45 Mita, Minato-ku, Tokyo 108-8345, Japan {mitsu, takemura}@abelard.flet.keio.ac.jp

Abstract. The purpose of this note is to give a demonstration of the completeness theorem of type assignment system for λ-terms of [Hindley 83] and [Coquand 05] with two directions of slight extensions. Firstly, using the idea of [Okada 96], [Okada-Terui 99] and [Hermant-Okada 07], we extend their completeness theorem to a stronger form which implies a normal form theorem. Secondly, we extend the simple type (the implicational fragment of intuitionistic logic) framework of [Hindley 83] and [Coquand 05] to a linear (aﬃne) types (the {−◦, &, →}-fragment of aﬃne logic) framework of [Laird 03, 05].

1

Introduction

Using the traditional Tarskian or Kripke model, Hindley [1983] and Coquand [2005] showed completeness at the level of “proof-terms” (λ-terms), in place of the traditional completeness for “provability,” with the implicational fragment of intuitionistic logic. Compared with some recent works on full completeness and full abstraction employing Scott-Plotkin’s denotational semantics or game semantics (e.g., [O’Hearn-Riecke 95], [Hyland-Ong 00]), their completeness proofs can be considered natural extensions of traditional completeness proofs for provability. On the other hand, in our previous work [Okada 96, 02] and [Okada-Terui 99], we remarked that a slight change in the phase semantic completeness proof of [Girard 87] leads to the cut-elimination theorem (or, existence theorem of a normal proof) for “provability.” In this note we combine these two ideas to show that a slight change in the setting of Hindley-Coquand’s semantic completeness proof for “proof-terms” leads to the normal form theorem for “proof-terms.” We demonstrate this for Laird’s dual aﬃne/intuitionistic λ-calculus.

This work is partly supported by Grants-in-Aid for Scientiﬁc Research of MEXT, a JST-Franco-Japanese collaborative grant, 21 COE-Humanity Science grant, and Oogata Kenkyu Josei grant of Keio University. The second author is also partly supported by Research Fellowships of the Japan Society for the Promotion of Science for Young Scientists.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 167–181, 2007. c Springer-Verlag Berlin Heidelberg 2007

168

M. Okada and R. Takemura

Girard proved, in his completeness proof in [Girard 87] at the level of provability, a lemma of the form A∗ = [[A]], where A∗ (called the inner-value of A in [Okada 02]) is the interpretation of a formula A in the canonical model, and [[A]] = {Γ | Γ A is provable} (called the outer-value). We remarked in [Okada 96], [Okada-Terui 99] (cf. also [HermantOkada 07] for higher order cases) that the cut-elimination theorem can be obtained by changing this lemma slightly into the following form: A ∈ A∗ ⊆ [[A]], where [[A]] = {Γ | Γ A is provable without the cut-rule }. Indeed, the completeness proofs for “proof-terms” in [Hindley 83] and [Coquand 05] use the same form A∗ = [[A]] as in [Girard 87], where A∗ and [[A]] are adapted to a semantics for “proof-terms.” We shall remark in this note that a modiﬁcation of the lemma similar to [Okada 96, 02] and [Okada-Terui 99] can show the normal form theorems for “proof-terms,” with a suitable change in the deﬁnition of [[A]]. As was mentioned above, we also extend completeness of [Hindley 83] and [Coquand 05] for the simple type (the implicational fragment of intuitionistic logic) framework to a linear (aﬃne) types (the {−◦, &, →}-fragment of aﬃne logic) framework. In order to do this, we consider dual aﬃne/intuitionistic λ-calculus (λAﬀ ) of [Laird 05, 03], which is a fragment of Dual Intuitionistic Linear Logic (DILL) of Barber and Plotkin (see [Barber 96]). Based on the linear types of the forms A −◦ B and A & B, λAﬀ has a part of the exponential as the intuitionistic function type of the form A → B, which corresponds to !A −◦ B with the exponential !. (Hasegawa [2002b] also considers a similar system in the framework of classical logic.) In [Laird 05, 03], λAﬀ is introduced as a target language of Continuation-Passing-Style (CPS) translation of simple types of the call-by-value λ-calculus. Introducing game semantics for λAﬀ , Laird gives a semantic analysis of λAﬀ and CPS translation. CPS translation is developed as an evaluation-order independent λ-encoding of λ-terms (see [Plotkin 75], [Fischer 93] etc.). Although the standard call-by-value CPS translation has been shown to be equationally sound and complete, it is not full: there are inhabitants of the interpreted types which are not in the image of the transformation. (See [Hasegawa 02a].) Using game semantics, Laird showed the fullness of CPS translation by adopting λAﬀ as the target language. Our completeness proof for “proof-terms” could be understood as a variant of the well-known Tait-Girard’s computability/reducibility argument of proofterms normalization. The rest of this note is organized as follows. In Section 2, we mainly concern ourselves with the level of “provability” of Laird’s dual aﬃne/intuitionistic λcalculus (λAﬀ ) ([Laird 05, 03]) and its phase semantics. In Section 3, we ﬁrst review the type assignment system of Laird’s λAﬀ , and then we introduce phase semantics for proof-terms of this system. We prove, in Section 4, the soundness and the completeness theorems of λAﬀ . Using completeness, we show a normal form theorem of λAﬀ .

Remarks on Semantic Completeness for Proof-Terms

2

169

Phase Semantics for the Provability of λAﬀ

In this section, we ﬁrst brieﬂy review the logic of Laird’s dual aﬃne/intuitionistic λ-calculus (λAﬀ ) ([Laird 05, 03]). Then we introduce phase semantics for the provability of this system for the preparation of phase semantics for proof-terms, which will be developed in Section 3.2. λAﬀ takes dual contexts of linear and non-linear in the style of BarberPlotkin’s Dual Intuitionistic Linear Logic (DILL) (see [Barber 96]). A sequent in this system has the form Φ ; Γ A, where Φ is a set of formulas (types) called “intuitionistic context”, and Γ is a multiset of formulas (types) called “linear context”, with A a formula (type). The symbol “ ; ” is used to distinguish an intuitionistic context and a linear context. We call Φ ; Γ a dual context. We write ∅ for the empty sequent. Syntactical notions such as formulas (types) and contexts of λAﬀ are deﬁned as the type assignment system for λ-terms in Section 3.1, and we only indicate the inference rules in Table 1 in this section. Table 1. Inference rules of λAﬀ

Φ ; Γ, A A

ax

Φ ; Γ, A B der Φ, A ; Γ B

Φ ; Γ, A B −◦I Φ ; Γ A −◦ B

Φ ; Γ A −◦ B Φ ; Δ A −◦E Φ ; Γ, Δ B

Φ, A ; Γ B →I Φ; Γ A→B

Φ; Γ A→B Φ; ∅A →E Φ; Γ B

Φ; Γ A Φ; Γ B &I Φ ; Γ A&B

Φ ; Γ A1 & A2 &Ei Φ ; Γ Ai

i = 1, 2

We introduce phase semantics for the provability of λAﬀ . First for comparison, we brieﬂy recall operations of usual phase semantics for the provability. See [Okada 02] for details. Phase semantics for the provability of the {−◦, &}fragment of intuitionistic linear logic is based on commutative monoid M and the following operations: For any α, β ⊆ M , - α −◦ β = {m | for any n ∈ α, m · n ∈ β}, - α & β = α ∩ β. We now introduce phase semantics for the provability of λAﬀ , based on intuitionistic phase semantics of [Okada 02]. See also [Okada-Terui 99] on phase semantics for aﬃne logic. Deﬁnition 1 (Phase space for the provability). A phase space M for the provability of λAﬀ is deﬁned as follows.

170

M. Okada and R. Takemura

Start with a structure (M, , ·, ε) where M is a set equipped with two binary commutative associative operators and · which share the same unit ε, and such that is also idempotent. Then the phase space which is used is the set of subsets of M = (M, , ε) × (M, ·, ε) with the following operations for any α, β ⊆ M. We denote an element of M as (n ; l) instead of (n, l). •

- α −◦ β = {(n ; l) | for any (n ; l ) ∈ α, (n n ; l · l ) ∈ β} - α → β = {(n ; l) | for any (n ; ε) ∈ α, (n n ; l) ∈ β} - α & β = α ∩ β. •

α ⊆ M is called closed if it satisﬁes the following monotonicity condition:

(Monotonicity) If (n ; l · l ) ∈ α, then (n l m ; l · k) ∈ α for any m, k ∈ M . This condition is a combination of Weakening and Dereliction (der-rule). Deﬁnition 2 (Phase model for the provability). A phase model (M, ∗) for the provability of λAﬀ consists of a phase space M for the provability and an interpretation function ∗ from the set of atoms to the set of closed sets of M. We write l for l1 · · · · · lk in a linear context, and n for n1 · · · nl and m for m1 · · · mk in an intuitionistic context. Deﬁnition 3 (Interpretation of sequents) A sequent C1 , . . . , Cl ; D1 , . . . , Dk A is true (denoted as C1 , . . . , Cl ; D1 , . . . , Dk |= A) in a phase model (M, ∗) for the provability of λAﬀ , if, for any (ni ; ε) ∈ Ci∗ and (mj ; lj ) ∈ Dj∗ , we have (n m ; l) ∈ A∗ . In the above deﬁnition of phase semantics, if we deﬁne an order relation in a monoid as m ≤ n iﬀ ∃l(m · l = n), then we obtain a linear (aﬃne) Kripke semantics naturally (see [Okada 04]). Hence our framework can be also considered as a framework of Kripke semantics as [Coquand 05]. Using the method of [Okada 96, 02] and [Okada-Terui 99], we have completeness of λAﬀ with respect to phase semantics for the provability. We shall also show that these theorems are obtained by proofs for corresponding theorems in Section 4. Theorem 1 (Soundness for the provability) If C1 , . . . , Cl ; D1 , . . . , Dk A is provable in λAﬀ , then C1 , . . . , Cl ; D1 , . . . , Dk |= A in any phase model for the provability of λAﬀ . In order to show completeness for the provability of λAﬀ , we construct a canonical model (MS , ∗) as follows. See Section 4.2 for the detail. MS is the set of dual contexts, where binary operators and · are “ , ” in intuitionistic contexts (set-union) and “ , ” in linear contexts (multiset-union), respectively, and the unit is the empty sequent ∅.

•

Remarks on Semantic Completeness for Proof-Terms •

171

On this set, we consider the following outer-value: - [[A]] = {Φ ; Γ | Φ ; Γ A is provable with a normal proof }

•

We deﬁne an interpretation function ∗ as X ∗ = [[X]].

Then we have the following main lemma by the induction on the complexity of A as [Okada 96, 02]. See Section 4.2 for the detail. Lemma 1 (Main lemma). In (MS , ∗), for any type A, (∅ ; A) ∈ A∗ ⊆ [[A]]. The following completeness is a direct consequence of the main lemma. Theorem 2 (Completeness for the provability) If C1 , . . . , Cl ; D1 , . . . , Dk |= A in any phase model for the provability of λAﬀ , then C1 , . . . , Cl ; D1 , . . . , Dk A is provable with a normal proof in λAﬀ . Then with the soundness theorem, the following normal form theorem is obtained. Theorem 3 (Normal form theorem for λAﬀ ) If C1 , . . . , Cl ; D1 , . . . , Dk A is provable in λAﬀ , then it is provable with a normal proof.

3

Phase Semantics for Proof-Terms of λAﬀ

In this section, we review the type assignment system of Laird’s dual aﬃne/intuitionistic λ-calculus (λAﬀ ) ([Laird 05, 03]), and we introduce phase semantics for proof-terms of this system. 3.1

Type Assignment System for λAﬀ

Although Barber [1996] and others, who study DILL or linear CPS-translation, introduce the linear λ-terms, we take, following [Laird 05, 03], the usual (non linear) untyped λ-terms with pairs for λAﬀ : Variables x, y, z, . . .; abstraction λx.s; application (st); pair s, t ; and projection π1 (s), π2 (s). We write s[x := t] for the substitution of a λ-term t for the free occurrences of x in a λ-term s. Deﬁnition 4 (Types). The linear types of λAﬀ is deﬁned as follows: - Atomic types X, Y, . . . , X1 , X2 , . . . are types. - If A and B are types, then A −◦ B, A → B and A & B are also types. We now deﬁne the type assignment rules of Laird’s λAﬀ .

172

M. Okada and R. Takemura

Deﬁnition 5 (Type asignment rules) - A declaration (assumption) is of the form x: A with a variable x and a type A. - A dual context is of the form y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk where the left of “ ; ” (y1 : C1 , . . . , yl : Cl ) is a ﬁnite set of declarations called an “intuitionistic context” and the right of “ ; ” (x1 : D1 , . . . , xk : Dk ) is a ﬁnite multiset of declarations called a “linear context”. We write Φ, Ψ, . . . for any intuitionistic contexts and Γ, Δ, . . . for any linear contexts. We write ∅ for the empty context. - A λ-term s is typable as type A if a sequent Φ ; Γ s: A is derivable for some dual context Φ ; Γ by the type assignment rules of Table 2.

Table 2. Type assignment rules of λAﬀ

Φ ; Γ, x: A x: A

ax

Φ ; Γ, x: A s: B der Φ, x: A ; Γ s: B

Φ ; Γ, x: A s: B −◦I Φ ; Γ λx.s: A −◦ B where s contains at most one free occurrence of x.

Φ ; Γ s: A −◦ B Φ ; Δ t: A −◦E Φ ; Γ, Δ (st): B

Φ, x: A ; Γ s: B →I Φ ; Γ λx.s: A → B

Φ ; Γ s: A → B Φ ; ∅ t: A →E Φ ; Γ (st): B

Φ ; Γ s: A Φ ; Γ t: B &I Φ ; Γ s, t: A & B

Φ ; Γ s: A1 & A2 &Ei Φ ; Γ πi (s): Ai

i = 1, 2

We introduce the βη-equality relation βη on λ-terms as the usual conversion relation, see [Hindley-Seldin 86], [Barendregt 92]. A λ-term is in normal form, if it contains no redex of the form (λx.st), πi ( s, t ) for i = 1 and 2, λx.(sx) for x ∈ F V (s), or π1 (s), π2 (s) , where F V (s) means the set of free variables of the λ-term s. Note that there is a slight diﬀerence between our λAﬀ and Barber-Plotkin’s DILL-style λAﬀ . In DILL-style λAﬀ , it is assumed that Φ and Γ are disjoint in a dual context Φ ; Γ , and further that Γ and Δ are disjoint in a linear context Γ, Δ. (See [Barber 96].) In our λAﬀ , in place of this assumption, we assume that −◦I-rule of Table 2 is applicable when s contains at most one free occurrence of x. This change does not aﬀect the type assignment system of λAﬀ , which can be stated in Proposition 1 bellow. Note ﬁrst that, if a sequent Φ ; Γ s: A is derivable in DILL-style λAﬀ , then the variables of the linear context Γ occur at most once in s due to the assumption of disjointness of linear contexts (see [Barber 96]). Hence −◦I-rule of DILL-style system satisﬁes the restriction of −◦I-rule of our λAﬀ . On the other hand, the following proposition means that any derivation of our λAﬀ can be simulated in DILL-style λAﬀ by considering duplicated

Remarks on Semantic Completeness for Proof-Terms

173

formulas in a linear context of our λAﬀ as an intuitionistic assumption of DILL-style λAﬀ . Proposition 1 (Simulation). Let xi : Ai be a sequence xi : Ai , . . . , xi : Ai of the same assumptions. Assume that no variable appears twice in a sequence of assumptions Φ, Γ, x1 : A1 , . . . , xn : An . For 0 ≤ k ≤ n, if Φ, x1 : A1 , . . . , xk : Ak ; Γ, x1 : A1 , . . . , xn : An s: B is derivable in our λAﬀ , then Φ, x1 : A1 , . . . , xn : An ; Γ s: B is derivable in DILL-style λAﬀ . This proposition is obtained by the following lemma of DILL-style λAﬀ . Lemma 2 (Environment strengthening (Cf. [?])) If Φ, x: A ; Γ s: B is derivable in DILL-style λAﬀ and s contains at most one free occurrence of x, then Φ ; Γ, x: A s: B is derivable in DILL-style λAﬀ . Let us consider the following example of an application of −◦I Φ ; Γ, x: A, x: A s: B −◦I Φ ; Γ, x: A λx.s: A −◦ B in our λAﬀ . For simplicity, we assume that no variable other than x occurs twice in the dual context. This form of −◦I-rule is simulated by DILL-style λAﬀ as follows: First we consider the duplicated assumptions (x: A, x: A) in the linear context of the upper sequent as an intuitionistic assumption as Φ, x: A ; Γ s: B in DILL-style λAﬀ . Note that by the deﬁnition of −◦I-rule of our λAﬀ , the λterm s contains at most one free occurrence of x. Hence by Lemma 2, we have Φ ; Γ, x: A s: B. Thus by applying −◦I-rule of DILL-style λAﬀ , we have the following derivation: Φ ; Γ, x: A s: B −◦I Φ ; Γ λx.s: A −◦ B in DILL-style λAﬀ . Then by Weakening (cf. [Barber 96]) we have Φ, x: A ; Γ λx.s: A −◦ B in DILL-style λAﬀ . 3.2

Phase Semantics for Proof-Terms of λAﬀ

In this subsection, we introduce phase semantics for proof-terms of λAﬀ . The domain of our model consists of untyped λ-terms with dual contexts, which corresponds to [Coquand 05]’s model. The operations −◦, → and & are based on the −◦, → elimination rules and the set theoretical intersection operation, which are natural extensions of those operations of phase semantics for the provability of λAﬀ (Deﬁnition 1). The following phase space for proof-terms is obtained by augmenting proof-terms (λ-terms) to a phase space for the provability of λAﬀ .

174

M. Okada and R. Takemura

Deﬁnition 6 (Phase space for proof-terms). A phase space for proof-terms of λAﬀ is (M, P) where •

M is a phase space for the provability of λAﬀ .

•

P = {((n ; l), s) | (n ; l) ∈ M and s is a λ-term}. We write (n ; l s) for ((n ; l), s). There are the following operations for any α, β ⊆ P: - α −◦ β = {(n ; l s) | for any (n ; l t) ∈ α, (n n ; l · l (st)) ∈ β} - α → β = {(n ; l s) | for any (n ; ε t) ∈ α, (n n ; l (st)) ∈ β} - α & β = π1 (α) ∩ π2 (β), where πi (α) = {(n ; l s) | (n ; l πi (s)) ∈ α} for i = 1, 2.

• We call α ⊆ P closed if it satisﬁes the following equality-closed and monotonicity conditions: (Equality-closed) If t βη s and (n ; l s) ∈ α, then (n ; l t) ∈ α; (Monotonicity) If (n ; l · l s) ∈ α, then (n m l ; l · k s) ∈ α for any m, k ∈ M .

These two conditions are collectively called the closure condition. Note that, in the above deﬁnition of phase space for proof-terms of λAﬀ , if we forget λ-terms (proof-terms), then (1) P coincides with M, (2) operations {−◦, →, &} exactly correspond to those of Deﬁnition 1 of phase space for the provability of λAﬀ , and (3) only monotonicity remains as the closure condition. Hence a phase space for the provability is obtained by forgetting λ-terms of a phase space for proof-terms. It is easily shown that the closure condition is preserved under {−◦, →, &}operations. Lemma 3. For any α, β ⊆ P, if β is closed then α −◦ β and α → β are closed; if α and β are closed then α & β is closed. Deﬁnition 7 (Phase model for proof-terms). A phase model (M, P, ∗) for proof-terms of λAﬀ consists of a phase space (M, P) for proof-terms of λAﬀ ; an interpretation function ∗ form the set of atomic types to the set of closed sets of (M, P) such that (A −◦ B)∗ = A∗ −◦ B ∗ , (A → B)∗ = A∗ → B ∗ , (A & B)∗ = A∗ & B ∗ .

• •

Note that any interpretation A∗ of a type is closed from Lemma 3. Notation: We write s[t, s] for s[y1 := t1 , . . . , yl := tl , x1 := s1 , . . . , xk := sk ]. We also write l for l1 · · · · · lk in a linear context, and n for n1 · · · nl and m for m1 · · · mk in an intuitionistic context. Deﬁnition 8 (Interpretation of sequents) A sequent y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk s: A is true (denoted as y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk |= s: A) in a phase model (M, P, ∗) for

Remarks on Semantic Completeness for Proof-Terms

175

proof-terms of λAﬀ , if, for any (ni ; ε ti ) ∈ Ci∗ and (mj ; lj sj ) ∈ Dj∗ , we have (n m ; l s[t, s]) ∈ A∗ .

4

Soundness and Completeness of λAﬀ

In this section, we prove the soundness and the completeness theorems. Our proof below is an extension of the completeness proof in [Okada 96, 02] for phase semantics for the provability of intuitionistic linear logic. Using completeness, we show a normal form theorem of λAﬀ : if a λ-term s is typable in λAﬀ , then there is a λ-term t in normal form such that s βη t . By the following completeness proof for proof-terms (λ-terms), we obtain completeness for the provability if we ignore the part related to λ-terms. 4.1

Soundness Theorem

We ﬁrst show the soundness theorem. Theorem 4 (Soundness for proof-terms) If y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk s: A is derivable in λAﬀ , then y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk |= s: A in any phase model for proof-terms of λAﬀ . Proof. By induction on the construction of derivation. As for elimination rules, the assertion is more or less immediate by the induction hypothesis since the corresponding operations in our phase model are deﬁned based on the elimination rules. Further, since → E-rule is a particular case of −◦I-rule, it is treated by the same way as −◦I case. Thus we show only for −◦I and &I rules. In the following, Φ denotes y1 : C1 , . . . , yl : Cl , and Γ denotes x1 : D1 , . . . , xk : Dk . Φ ; Γ, x: A s: B Case Φ ; Γ λx.s: A −◦ B −◦I . Let (ni ; ε ti ) ∈ Ci∗ and (mj ; lj sj ) ∈ Dj∗ for each 1 ≤ i ≤ l and 1 ≤ j ≤ k. Then by the induction hypothesis, for any (n ; l u) ∈ A∗ , we have (n m n ; l · l s[t, s, x := u]) ∈ B ∗ . Since B ∗ is closed, we have (n m n ; l·l(λx.su)[t, s]) ∈ B ∗ . That is (nm ; lλx.s[t, s]) ∈ A∗ −◦B ∗ by the deﬁnition of −◦. Case

Φ ; Γ s: A Φ ; Γ t: B &I . Φ ; Γ s, t : A & B

Let (ni ; ε ti ) ∈ Ci∗ and (mj ; lj sj ) ∈ Dj∗ . Then by the induction hypothesis, we have (n m ; l s[t, s]) ∈ A∗ and (n m ; l t[t, s]) ∈ B ∗ . Since both A∗ and B ∗ are closed, we have (n m ; l π1 s, t [t, s]) ∈ A∗ and (n m ; l π2 s, t [t, s]) ∈ B ∗ . Thus, from the deﬁnition of &, we have (n m ; l s, t [t, s]) ∈ A∗ & B ∗ . Note that the soundness theorem (Theorem 1) for the provability is a direct corollary of this soundness theorem for proof-terms.

176

4.2

M. Okada and R. Takemura

Completeness Theorem

In this subsection, we present the completeness theorem. For the sake of a normal form theorem, we consider the following form of main lemma for completeness: (∅ ; x: A x) ∈ A∗ ⊆ [[A]] for any variable x and any type A, where A∗ is the interpretation of A in the canonical model, and [[A]] = {(Φ ; Γ s) | Φ ; Γ s: A and there is t in normal form such that s βη t} (called the outer-value of A). This is a modiﬁcation of the lemma of [Coquand 05] following the method of [Okada 96, 02]. In order to show completeness of λAﬀ , we add the following equality-rule: Φ ; Γ s : A s βη t eq Φ ; Γ t: A This type of equality-rule is used in [Hindley 83] and [Coquand 05] to show completeness. Now we construct a canonical model (MS , PS , ∗) as follows. MS is the set of dual contexts, where binary operators and · are “ , ” in intuitionistic contexts (set-union) and “ , ” in linear contexts (multiset-union), respectively, and the unit is the empty sequent ∅.

•

•

PS = {(Φ ; Γ s) | (Φ ; Γ ) ∈ MS and s is a λ-term }.

•

On this set, we consider the following outer-value: - [[A]] = {(Φ ; Γ s) | Φ ; Γ s: A and there is t in normal form such that s βη t}.

•

Then we deﬁne an interpretation function ∗ as X ∗ = [[X]].

Note that we can deﬁne another outer-value as [[A]]T = {(Φ ; Γ s) | Φ ; Γ s: A} without referring any normal form nor equality relation on λ-terms. The completeness theorem of [Coquand 05] is obtained by this outer-value. The above construction indeed produces a phase model for proof-terms. Lemma 4. (MS , PS , ∗) is a phase model for proof-terms of λAﬀ . Now we prove the following main lemma for our completeness theorem. Lemma 5 (Main lemma). In MS , for any variable x and any type A, (∅ ; x: A x) ∈ A∗ ⊆ [[A]].

Remarks on Semantic Completeness for Proof-Terms

177

Proof. In order to prove this lemma, we ﬁrst introduce the following meta expression for a type and a λ-term. For any type B1 , . . . , Bn , we ﬁrst deﬁne, by the induction on n, a meta expression E(B1 , . . . , Bn ) of a type as follows: (n = 1) E(B1 ) means B1 ; (n > 1) E(B1 , . . . , Bn ) means one of the followings; - E(B1 , . . . , Bn−2 , (Bn−1 −◦ Bn )) or; - E(B1 , . . . , Bn−2 , (Bn−1 → Bn )) or; - E(B1 , . . . , Bn−2 , (Bn & Bn−1 )) or; - E(B1 , . . . , Bn−2 , (Bn−1 & Bn )). Next, for any term s1 , . . . , sn which have types B1 , . . . , Bn respectively, we introduce a meta expression E(sn , s1 , . . . , sn−1 ) of a λ-term, which depends on the form of a type E(B1 , . . . , Bn ) as follows: E(sn ) is sn ; E(sn , s1 , . . . , sn−1 ) is one of the following: - an application (E(sn , s1 , . . . , sn−2 )sn−1 ) if E(B1 , . . . , Bn−1 , Bn ) is E(B1 , . . . , (Bn−1 −◦ Bn )) or E(B1 , . . . , (Bn−1 → Bn )); - a projection π1 (E(sn , s1 , . . . , sn−2 )) if E(B1 , . . . , Bn−1 , Bn ) is E(B1 , . . . , (Bn & Bn−1 )); - a projection π2 (E(sn , s1 , . . . , sn−2 )) if E(B1 , . . . , Bn−1 , Bn ) is E(B1 , . . . , (Bn−1 & Bn )). If we consider only {−◦, →}-fragment, then a λ-term E(x, s1 , . . . , sn ) is just an application (· · · (xs1 ) · · · sn ), and from a proof-theoretical point of view, it correspond to a proof structure whose main branch consists only of {−◦, →}elimination rules. (Cf. [Martin-L¨ of 71].) Then we prove, by induction on the complexity of A, the conjunction of the following two statements (1) and (2), which is a generalized form of the main lemma. (1) A∗ ⊆ [[A]]; (2) For any type E(B1 , . . . , Bn , A), if (Φ ; Γi si ) ∈ [[Bi ]] for any i ≤ n such that E(B1 , . . . , Bi−1 , (Bi −◦ D)); and if (Φ ; ∅ sj ) ∈ [[Bj ]] for any j ≤ n such that E(B1 , . . . , Bj−1 , (Bj → D)), then we have (Φ ; Γ i , x: E(B1 , . . . , Bn , A) E(x, s1 , . . . , sn )) ∈ A∗ , where Γ i is a sequence of contexts appearing in the premise of the statement. In particular, we have (∅ ; x: A x) ∈ A∗ from the case n = 0 of (2). We write E(B n , A) for the type E(B1 , . . . , Bn , A), and write E(x, s n ) for the λ-term E(x, s1 , . . . , sn ). (Case A ≡ X) (1) X ∗ ⊆ [[X]] is obvious from the deﬁnition.

178

M. Okada and R. Takemura

(2) By the assumption we have Φ ; Γi si : Bi for each i and Φ ; ∅ sj : Bj for each j, hence from the axiom of the form Φ ; x: E(B n , X) x: E(B n , X)

ax ,

by applying n-times of the following form of elimination rules: Φ ; Γl , x: E(Bn , X) E(x, si ) : Bi+1 ⇒ E(Bi+2 , . . . , Bn , X) Φ ; Γi+1 si+1 : Bi+1 ⇒E Φ ; Γl , Γi+1 , x: E(Bn , X) (E(x, si )si+1 ): E(Bi+2 , . . . , Bn , X)

where ⇒ is −◦ or →, and Γi+1 is ∅ if ⇒ is →, or Φ ; Γl , x: E(Bn , X) E(x, si ): E(Bi+2 , . . . , Bn , X) & Bi+1 &E1 Φ ; Γl , x: E(Bn , X) π1 (E(x, si )): E(Bi+2 , . . . , Bn , X)

similar for &E2 ,

we obtain Φ ; Γ i , x: E(B n , X) E(x, s n ): X. On the other hand there are λ-terms u1 , . . . , un in normal forms such that sk uk for each 1 ≤ k ≤ n by the assumption. Hence we have E(x, s1 , . . . , sn ) βη E(x, u1 , . . . , un ) where E(x, u1 , . . . , un ) is in normal form. Thus we obtain (Φ ; Γ i , x: E(B n , X) E(x, s1 , . . . , sn )) ∈ [[X]] = X ∗ . (Case A ≡ B −◦ C) (1) We show B ∗ −◦ C ∗ ⊆ [[B −◦ C]]. Let (Φ ; Γ s) ∈ B ∗ −◦ C ∗ . Then for any (Ψ ; Δ t) ∈ B ∗ , we have (Φ, Ψ ; Γ, Δ (st)) ∈ C ∗ . Since we have (∅ ; x: B x) ∈ B ∗ for any x by the induction hypothesis on B of the case n = 0, we have (Φ ; Γ, x: B (sx)) ∈ C ∗ for x ∈ F V (s). Then by the induction hypothesis on C, we have Φ ; Γ, x: B (sx): C and there is u in normal form such that (sx) βη u. Then by applying the following −◦I-rule Φ ; Γ, x: B (sx): C −◦I Φ ; Γ λx.(sx): B −◦ C , we have Φ ; Γ λx.(sx): B −◦ C and λx.(sx) βη λx.u. Note that λx.u is not necessarily in normal form even if u is in normal form. Thus we divide the following two cases depending on u. (i) If u is of the form (vx), then we have s η λx.(sx) λx.u ≡ λx.(vx) η v. Note that v is in normal form since u is in normal form, and that we have Φ ; Γ s: B by the equality-rule. (ii) If otherwise, λx.u is in normal form since u is in normal form. Hence from (sx) u, we have s η λx.(sx) λx.u, and we have Φ ; Γ s: B by the equality-rule. Hence in either case, we have (Φ ; Γ s) ∈ [[B −◦ C]]. (2) We show that for any (Φ ; Γ t) ∈ B ∗ , we have (Φ ; Γi , Γ, x: E(B1 , . . . , Bn , (B −◦ C)) (E(x, s1 , . . . , sn )t)) ∈ C ∗ . ¿From the assumption (Φ ; Γ t) ∈ B ∗ , we

Remarks on Semantic Completeness for Proof-Terms

179

have (Φ ; Γ t) ∈ [[B]] by the induction hypothesis on B. Since E(B1 , . . . , Bn , (B −◦ C)) is expressed as E(B1 , . . . , Bn , B, C) and (E(x, s1 , . . . , sn )t) is E(x, s1 , . . . , sn , t), we have the assertion by the induction hypothesis on C. (Case A ≡ B → C) We omit a proof for this case since it is treated by the similar way as −◦. (Case A ≡ B & C) (1) We show B ∗ & C ∗ ⊆ [[B & C]]. Let (Φ ; Γ s) ∈ B ∗ & C ∗ . Then we have (Φ ; Γ π1 (s)) ∈ B ∗ and (Φ ; Γ π2 (s)) ∈ C ∗ . Then by the induction hypothesis on B and C respectively, we have Φ ; Γ π1 (s): B and there is u in normal form such that π1 (s) βη u, and we have Φ ; Γ π2 (s): C and there is v in normal form such that π2 (s) βη v. Thus by the following &I-rule Φ ; Γ π1 (s): B Φ ; Γ π2 (s): C &I Φ ; Γ π1 (s), π2 (s) : B & C , we have Φ ; Γ π1 (s), π2 (s) : B & C and π1 (s), π2 (s) βη u, v . Thus we divide the following two cases depending on u and v. (i) If u is of the form π1 (t) and v is of the form π2 (t), then we have s η π1 (s), π2 (s) u, v ≡ π1 (t), π2 (t) η t. Note that t is in normal form since u and v are in normal forms, and that we have Φ ; Γ s: B & C by the equalityrule. (ii) If otherwise, u, v is in normal form since u and v are in normal forms. Hence from π1 (s) u and π2 (s) v, we have s η π1 (s), π2 (s) u, v , and Φ ; Γ s: B & C by the equality-rule. Hence in either case, we have (Φ ; Γ s) ∈ [[B & C]]. (2) We show that (Φ ; Γ i , x: E(B1 , . . . , Bn , (B &C))π1 (E(x, s1 , . . . , sn ))) ∈ B ∗ and (Φ ; Γ i , x: E(B1 , . . . , Bn , (B & C)) π2 (E(x, s1 , . . . , sn ))) ∈ C ∗ . Since E(B1 , . . . , Bn , (B & C)) is expressed as E(B1 , . . . , Bn , B, C) and πi (E(x, s1 , . . . , sn )) for i = 1, 2 are E(x, s1 , . . . , sn , sn+1 ) respectively, we have the assertion by the induction hypothesis on B and C respectively. Assume that, for any (ni ; ε ti ) ∈ Ci∗ and (mj ; lj sj ) ∈ Dj∗ , we have (n m ; l s[t, s]) ∈ A∗ in any phase mode for proof-terms. Then we have (y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk s) ∈ A∗ in the canonical model, since (yi : Ci ; ∅) ∈ Ci∗ and (∅ ; xj : Dj ) ∈ Dj∗ for any Ci and Dj by the main lemma and the monotonicity. Hence by the main lemma A∗ ⊆ [[A]], the sequent y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk s: A is derivable in λAﬀ and there is t in normal form such that s βη t. Thus we obtain the following completeness theorem for proof-terms of λAﬀ . Theorem 5 (Completeness for proof-terms) If y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk |= s: A in any phase model for proofterms of λAﬀ , then y1 : C1 , . . . , yl : Cl ; x1 : D1 , . . . , xk : Dk s: A is derivable in λAﬀ , and there is t in normal form such that s βη t.

180

M. Okada and R. Takemura

Note that the completeness theorem (Theorem 2) for provability is a direct corollary of this completeness theorem for proof-terms. If a λ-term s is typable in λAﬀ , then by the soundness, the premise of the completeness is satisﬁed. Hence by the completeness, we have the following normal form theorem of λAﬀ . Corollary 1 (Normal form theorem). If a λ-term s is typable in λAﬀ , then there is a λ-term t in normal form such that s βη t.

5

Concluding Remarks

We remarked that the completeness theorem of type assignment system of [Coquand 05] in the simple type framework can be extended to a stronger form which implies a normal form theorem in a linear (aﬃne) types framework with Laird’s dual aﬃne/intuitionistic λ-calculus. In order to prove completeness, we introduced, following [Hindley 83] and [Coquand 05], an equality-rule. This equality-rule makes some usually untypable λ-terms typable. It seems that this equality-rule is essential to prove completeness in our framework of λAﬀ which has η-rule for &, since the subject reduction property fails for this reduction. We remark that, in the framework without & nor η-rule, the following weaker form of completeness holds without having the additional equality-rule: If (Γ s) ∈ A∗ for any model, then there is a λ-term t such that s t and Γ t: A is derivable, which naturally implies completeness at the level of the provability. ¿From the phase semantic point of view, the {−◦, &, →}-fragment of ILL is complete with respect to intuitionistic phase semantics without any closure condition, which is a generalization of the double negation operation ( )⊥⊥ . Cf. [Abrusci 90] and [Okada 02] for the phase semantic closure. Hence our closure condition (the equality-closed and the monotonicity conditions) is not related to the closure condition of intuitionistic phase semantics for the provability. As future work, we investigate whether or not our closure condition in phase semantics for proof-terms can be considered as an extension of the closure condition of intuitionistic phase semantics for the provability.

References [Abrusci 90] Michele, V.: Abrusci, Sequent calculus for intuitionistic linear propositional logic, Mathematical Logic, Plenum, New York, pp. 223–242 (1990) [Barber 96] Barber, A.: Dual Intuitionistic Linear Logic, Technical Report ECS-LFCS96-347, University of Edinburgh (1996) [Barendregt 92] Barendregt, H.P.: Lambda Calculi with Types. In: Abramsky, S., Gabbay, D.M., Maibaum, T.S.E. (eds.) Handbook of logic in computer science, vol. 2, pp. 117–309. Oxford University Press, Oxford (1992) [Coquand 05] Coquand, T.: Completeness Theorems and lambda-Calculus. In: Urzyczyn, P. (ed.) TLCA 2005. LNCS, vol. 3461, pp. 1–9. Springer, Heidelberg (2005)

Remarks on Semantic Completeness for Proof-Terms

181

[Fischer 93] Michael, J.: Lambda-Calculus Schemata. Lisp. and Symbolic Computation 6(3-4), 259–288 (1993) [Girard 87] Girard, J.-Y.: Linear Logic, Theoretical Computer Science, vol. 50 (1987) [Hasegawa 02a] Hasegawa, M.: Linearly used eﬀects: monadic and CPS transformations into the linear lambda calculus. In: Hu, Z., Rodr´ıguez-Artalejo, M. (eds.) FLOPS 2002. LNCS, vol. 2441, pp. 167–182. Springer, Heidelberg (2002) [Hasegawa 02b] Hasegawa, M.: Classical linear logic of implications. In: Bradﬁeld, J.C. (ed.) CSL 2002 and EACSL 2002. LNCS, vol. 2471, pp. 458–472. Springer, Heidelberg (2002) [Hermant-Okada 07] Hermant, O., Okada, M.: A semantics for cut elimination in intensional higher-order Linear Logic (In preparation) (2007) [Hindley 83] Hindley, J.R.: The Completeness Theorem for Typing lambda-Terms. Theoretical Computer Science 22, 1–17 (1983) [Hindley-Seldin 86] Hindley, J.R., Seldin, J.P.: Introduction to Combinators and Lambda-Calculus. Cambridge University Press, Cambridge (1986) [Hyland-Ong 00] Hyland, J.M.E., Luke, C.-H.: On Full Abstraction for PCF: I, II, and III. Information and Computation 163(2), 285–408 (2000) [Laird 03] Laird, J., Game, A.: Semantics of Linearly Used Continuations. In: Gordon, A.D. (ed.) ETAPS 2003 and FOSSACS 2003. LNCS, vol. 2620, pp. 313–327. Springer, Heidelberg (2003) [Laird 05] Laird, J.: Game Semantics and linear CPS interpretation. Theoretical Computer Science 333, 199–224 (2005) [Martin 71] Martin-L¨ of, P.: Hauptsatz for the intuitionistic theory of iterated inductive deﬁnitions, In: Fenstad, J.E. (ed.) Proceedings of the Second Scandinabian Logic Symposium, North-Holland, pp. 179–216 (1971) [Mitchell 90] Mitchell, J.C.: Type Systems for Programming Languages, Handbook of Theoretical Computer Science, vol. B, pp. 365–458 (1990) [O’Hearn-Riecke] O’Hearn, P.W., Riecke, J.G.: Kripke Logical Relations and PCF. Information and Computation 120(1), 107–116 (1995) [Okada 96] Okada, M.: Phase semantics for higher order completeness, cut-elimination and normalization proofs (Extended Abstract). Electronic Notes in Theoretical Computer Science 3, 22 (1996) [Okada 99] Okada, M.: Phase semantic cut-elimination and normalization proofs of ﬁrst- and higher-order linear logic. Theoretical Computer Science 227, 333–396 (1999) [Okada 02] Okada, M.: A Uniform semantic proof for cut-elimination and completeness of various ﬁrst and higher order logics. Theoretical Computer Science 281, 471–498 (2002) [Okada 04] Okada, M.: Intuitionistic logic and linear logic. La. revue internationale de philosophie, special issue ”Intuitionism” 230, 449–481 (2004) [Okada-Terui 99] Okada, M., Terui, K.: The Finite Model Property for Various Fragments of Intuitionistic Linear Logic. Journal of Symbolic Logic 64, 790–802 (1999) [Plotkin 75] Plotkin, G.D.: Call-by-Name, Call-by-Value and the lambda-Calculus. Theoretical Computer Science 1(2), 125–159 (1975)

Linear Recursive Functions Sandra Alves1, , Maribel Fern´ andez2 , M´ ario Florido1 , and Ian Mackie3, 1

University of Porto, Department of Computer Science & LIACC, R. do Campo Alegre 823, 4150-180, Porto, Portugal 2 King’s College London, Department of Computer Science, Strand, London WC2R 2LS, UK 3 ´ LIX, CNRS UMR 7161, Ecole Polytechnique, 91128 Palaiseau Cedex, France

Abstract. With the recent trend of analysing the process of computation through the linear logic looking glass, it is well understood that the ability to copy and erase data is essential in order to obtain a Turingcomplete computation model. However, erasing and copying don’t need to be explicitly included in Turing-complete computation models: in this paper we show that the class of partial recursive functions that are syntactically linear (that is, partial recursive functions where no argument is erased or copied) is Turing-complete. Keywords: Recursion theory, linear calculi, iteration, computable functions.

1

Introduction

In the deﬁnition of recursive functions, together with recursion, a key mechanism in the process of computation is the ability for functions to duplicate and to discard their arguments (i.e., management of resources: erase and copy). In this paper we focus on this aspect of computation, which has attracted a great deal of attention in recent years. We say that a function is linear if it uses its arguments exactly once. Primitive recursive functions, which we shall call PR, are a class of functions which form an important building block on the way to a full formalisation of computability. Intuitively speaking, (partial) recursive functions are those that can be computed by some Turing machine. Primitive recursive functions can be computed by a speciﬁc class of Turing machines that always halt. Many of the functions normally studied in number theory, and approximations to real-valued functions, are primitive recursive: addition, division, factorial, exponential, ﬁnding the nth prime, and so on [9]. In fact, it is diﬃcult to devise a function that

Research partially supported by the Treaty of Windsor Grant: “Linearity: Programming Languages and Implementations”, and by funds granted to LIACC through the Programa de Financiamento Plurianual, Funda¸c˜ ao para a Ciˆ encia e Tecnologia and FEDER/POSI. Programa Gulbenkian de Est´ımulo ` a Investiga¸ca ˜o. Projet Logical, Pˆ ole Commun de Recherche en Informatique du plateau de Saclay, ´ CNRS, Ecole Polytechnique, INRIA, Universit´e Paris-Sud.

H. Comon-Lundh et al. (Eds.): Jouannaud Festschrift, LNCS 4600, pp. 182–195, 2007. c Springer-Verlag Berlin Heidelberg 2007

Linear Recursive Functions

183

is not primitive recursive; Ackermann’s function is a well-known example of a non-primitive recursive function. The class of PR functions is the least set including the zero, successor and projection functions, and closed under the operations of composition and primitive recursion. In the deﬁnition of PR, zero and successor give access to the natural numbers and the projection functions are useful for erasing, copying and permuting arguments. Copying and erasing (i.e., the ability for functions to duplicate and to discard their arguments) are key operations in the deﬁnition of all interesting functions by primitive recursion, and in particular in the deﬁnition of the two operations used to deﬁne PR itself: composition and the primitive recursive scheme. In this context the following question arises: can we deﬁne the class of primitive recursive functions without explicitly relying on copying and erasing? In this paper we show that the answer is yes; more precisely, we show that any primitive recursive function can be deﬁned using a syntactically linear system. Furthermore, we show that any computable function can be deﬁned using a single minimisation operator and linear functions. This yields an alternative formulation of the theory of recursive functions, where each function is linear; we call this class of functions linear recursive functions. To deﬁne linear primitive recursive functions, which we shall call LPR, we start by specifying a set of linear initial functions (projections are not linear, so we will use natural numbers and the identity function), together with composition of linear functions and a linear primitive recursive scheme (i.e., primitive recursion where each function uses its arguments exactly once). Linear primitive recursive functions oﬀer an implicit approach to copying and erasing. We can express both the process of copying a number and the process of erasing a number, as linear primitive recursive functions. Thus, the classes PR and LPR coincide. Summarising, our main contributions are: – Deﬁnition of linear primitive recursive functions (LPR)—a class of functions deﬁned by the initial functions zero, successor, and identity, together with linear composition and pure iteration. – Simulation of erasing and copying in LPR, in particular, projections can be simulated by permutation followed by a linear erasing. Using this result, we show that LPR and PR are exactly the same class of functions. – Any general recursive function (i.e., any computable function) can be obtained if we add a minimisation operator working on linear primitive recursive functions. This work exhibits a redundancy in the deﬁnition of recursive functions, and shows that a minimalistic deﬁnition of primitive recursion, based on linear functions, is suﬃcient. This is one more indication of the power of linear functions. Related work: There are several alternative deﬁnitions of the primitive recursion scheme [22,15,16,21,10]. In some of these works, for instance [16,10], primitive

184

S. Alves et al.

recursion was replaced by pure iteration. Pure iteration is a linear scheme, in the sense that arguments of functions are used exactly once. Gladstone [16] gave a deﬁnition of primitive recursion using the standard initial functions and composition, but replaced primitive recursion by pure iteration. Here we reﬁne this deﬁnition by replacing also the initial functions (by linear initial functions) and the composition scheme (by a linear composition scheme). We then show that this deﬁnes a set of linear functions that corresponds exactly to the primitive recursive functions. Burroni [10] deﬁned a category of primitive recursive functions with rather intuitive graphic descriptions of its objects. The deﬁnition of PR in this category is very close to ours (in particular iteration is also used instead of primitive recursion). The main diﬀerence from our work is the underlying approach: Burroni uses a categorical approach, while we use a standard recursion theory approach in the deﬁnition of PR. As an example of this, in [10], the construction of natural numbers uses an axiom similar to the Peano-Lawvere [19] axiom (more suitable in a categorical approach), instead of the Peano axioms which build numbers using the successor function. There are several formalisms based on the notion of linearity that limit the use of copy and erasing. This includes languages based on a version of the λ-calculus with a type system corresponding to intuitionistic linear logic [12]. This calculus (which can be seen as a minimal functional programming language) provides explicit syntactical constructs for copying and erasing terms (corresponding to the exponentials in linear logic) [1]. From another perspective there have been a number of calculi, again many based on linear logic, for capturing speciﬁc complexity classes ([6,11,14,7,18,25,8]). One of the main examples is that of bounded linear logic [14], which captures the class of polynomial time computable functions. This paper is part of a research project which aims at studying the notion of linearity in computation, and at analysing the computation power of linear systems. The results described here provide the foundations for a series of results, including the deﬁnition of a linear version of G¨ odel’s System T [2] with a decidable typing system for polymorphic iteration [4]. Current research in this area includes the deﬁnition of an alternative version of System T which uses the linear λ-calculus and pure iteration with standard (monomorphic) linear types, without losing any of the computational power of G¨ odel’s original deﬁnition. This paper is also a starting point for studying the connection between cartesian closed categories and symmetric monoidal closed categories. This work, which began in [20], studies this question using the internal languages (which are respectively the λ-calculus and the linear λ-calculus). In the next section we recall the background material. In Section 3 we deﬁne the linear primitive recursive functions, and in Section 4 we show how any PR function can be encoded as an LPR function and vice versa. In Section 5 we deﬁne linear recursive functions and show that any computable function can be written as a linear recursive function. Section 6 brieﬂy discusses higher-order primitive recursion. Finally we conclude the paper in Section 7.

Linear Recursive Functions

2

185

Background

We assume familiarity with recursion theory, and recall some basic notions along the lines presented in [23]. We refer to reader to [23] for more details. 2.1

Primitive Recursive Functions

Notation: We use x1 , . . . , y1 , . . . to represent natural numbers, f, g, h to represent functions and X1 , . . . to represent sequences of the form x1 , . . . , xn . We only have tuples on natural numbers, thus we will work modulo associativity for simplicity: (X1 , (x1 , x2 ), X2 ) = (X1 , x1 , x2 , X2 ). Deﬁnition 1 (Primitive recursive functions). A function f : Natk → Nat is primitive recursive if it can be deﬁned from a set of initial functions using composition and the primitive recursive scheme deﬁned as: – Initial functions: 1. The natural numbers, built from 0 and the successor function S. (We write n or Sn 0 for S . . . (S 0).) n

2. Projection functions: pr ni (x1 , . . . , xn ) = xi (1 ≤ i ≤ n); we omit the superindex when there is no ambiguity. – Composition, which allows us to deﬁne a primitive recursive function h using auxiliary functions f , g1 , . . . , gn where n ≥ 0: h(X) = f (g1 (X), . . . , gn (X)). – The primitive recursive scheme, which allows us to deﬁne a recursive function h using two auxiliary primitive recursive functions f , g: h(X, 0) = f (X) h(X, S n) = g(X, h(X, n), n). In [16] it was shown that primitive recursion could be replaced by a more restricted recursion scheme, called pure iteration: hg (X, 0) = X hg (X, S n) = g(hg (X, n)). The function hg (X, n), obtained by the last scheme, is the result of applying the function g n times to X. Hence we may write hg (X, n) to denote the function g n (X). In the sequel we sometimes use the notation hf for the operator that iterates f (using the pure iteration scheme). We do not have constant functions of the form C(X) = x as initial functions. However, we can see 0 as a constant function with no arguments, and every other constant function can be built by composition of 0 and S, and projections. For instance, the constant function zero(x, y) = 0 is deﬁned as an instance of composition (using the initial, 0-ary function 0) and one(x, y) = S(zero(x, y)), again as an instance of the composition scheme. Note also, that functions obtained from primitive recursive functions by introducing “dummy” variables, permuting variables, or repeating variables, are also primitive recursive functions. To keep our deﬁnitions simple, we will sometimes omit the deﬁnition of those functions. We give some examples below.

186

S. Alves et al.

Example 1. Consider the standard functions add and mul from Nat2 to Nat: add(x, y) = x + y

mul(x, y) = x ∗ y

The function add can be deﬁned by primitive recursion as follows: add(x, 0) = f (x) add(x, S n) = g(x, n, add(x, n)) where f (x) = pr 1 (x) =x g(x1 , x2 , x3 ) = S(pr 3 (x1 , x2 , x3 )) = S(x3 ) The primitive recursive function mul is deﬁned by: mul(x, 0) = f (x) mul(x, S n) = g(x, n, mul(x, n)) where f (x) =0 g(x1 , x2 , x3 ) = add(pr 1 (x1 , x2 , x3 ), pr 3 (x1 , x2 , x3 )) = add(x1 , x3 ) In the sequel, we consider primitive recursive functions from Natk to Natl , since every primitive recursive function from Natk to Natl can be transformed into a primitive recursive function from Natk to Nat, and vice versa (see [24] for details). 2.2

Recursive Functions

Deﬁnition 2 (Minimisation). Let f be a total function from Natn+1 to Nat. The function g from Natn to Nat is called the minimisation of f and is deﬁned as: g(X) = min{y | f (X, y) = 0}. We denote g as μy (f ). Deﬁnition 3 (Recursive functions). The set of (partial) recursive functions is deﬁned as the smallest set of functions containing the natural numbers (built from 0 and the successor function S) and the projection functions, and closed by composition, primitive recursion and minimisation. In particular, every primitive recursive function is recursive (since in both definitions we use the same initial functions, composition and primitive recursive scheme). Closure by minimisation implies that for every n ≥ 0 and every total recursive function f : Natn+1 → Nat, the function Mf : Natn → Nat deﬁned by Mf = μy (f ) is a recursive function. We recall the following result from Kleene [17]. Theorem 1 (The Kleene normal form). Let h be a partial recursive function on Natk . Then, a number n can be found such that h(x1 , . . . , xk ) = f (μy (g(n, x1 , . . . , xk , y))) where f and g are primitive recursive functions.

Linear Recursive Functions

3

187

Linear Primitive Recursive Functions

Deﬁnition 4. A function f : Natk → Natj is linear primitive recursive if it can be deﬁned from a set of linear initial functions using linear composition and the linear primitive recursive scheme deﬁned as follows: – Initial functions: 1. The natural numbers, built from 0 and the successor function S. We write n or Sn 0 for S . . . (S 0). n

2. The identity function (Id). – Linear composition, which allows us to deﬁne a function h using auxiliary linear primitive recursive functions f , g1 , . . . , gk : h(x1 , . . . , xn ) = f (g1 (X1 ), . . . , gk (Xk )), where (X1 , . . . , Xk ) = (x1 , . . . , xn ). – Pure iteration, which allows us to deﬁne a recursive function hg using an auxiliary linear primitive recursive function g: hg (X, 0) = X hg (X, S n) = g(hg (X, n)). Note that the condition (X1 , . . . , Xk ) = (x1 , . . . , xn ) in the deﬁnition of linear composition above is simply a concise way of saying that each argument of the function h must be used exactly once in the composition (it may seem that this condition also restricts the order in which arguments are used, but we will show below that permutations can be deﬁned as primitive recursive functions). Example 2. A simple example of a linear primitive recursive function is addition. It can be deﬁned as follows, where g(x) = S(x): addg (x, 0) = x addg (x, S n) = g(addg (x, n)). Gladstone [16] deﬁned the primitive recursive functions using the standard initial functions and composition, with pure iteration as a recursion scheme (indeed the name comes from [16]). Burroni [10], from a categorical approach, gave a deﬁnition of PR that is very close to ours, except that a diﬀerent construction of natural numbers is given. 3.1

Some Useful Linear Primitive Recursive Functions

Erasing the last element of a tuple. The function Elast , which erases the last element of a tuple, is deﬁned as: Elast (X, 0) = X Elast (X, S n) = Id(Elast (X, n))

188

S. Alves et al.

Lemma 1. For any X and number n, Elast (X, n) = X. Proof. By induction: Elast (X, 0) = X and Elast (X, S n) = Id(Elast (X, n)) = Id(X) = X. We can use the fact that we can erase the last element of a tuple, to erase at any position. We deﬁne Ei , the function that erases element i of a tuple as: Ei (x1 , . . . , xn ) = Id(Elast (x1 , . . . , xi ), Id(xi+1 , . . . , xn ))

Lemma 2. Ei (x1 , . . . , xn ) = (x1 , . . . , xi−1 , xi+1 , . . . , xn ). Proof. Follows from the correctness of Elast . The zero function. Using the function that erases the last element one can deﬁne a function zero, such that zero(X) = 0. The function zero is deﬁned as: zero(x1 , . . . , xn ) = Elast . . . Elast (0, x1 , . . . , xn ) n

Lemma 3. For any X, zero(X) = 0. Proof. By induction on the length of the tuple X. Linear copying. We now deﬁne copying using pure iteration. The function Ck1 produces k copies of a number: f (x1 , . . . , xk ) = Id(Sx1 , . . . , Sxk ) Ck1 (n) = hf ((0, . . . , 0), n), k

where hf denotes the function obtained by using the pure iteration scheme with the auxiliary function f . Lemma 4. For any number n, and any k > 0, Ck1 (n) = (n, . . . , n). k

Proof. By induction: Ck1 (0) = hf ((0, . . . , 0), 0) = (0, . . . , 0), and k

k

Ck1 (S n) = hf ((0, . . . , 0), S n) = f (hf ((0, . . . , 0), n)) = f (n, . . . , n) = (S n, . . . , S n). k

k

k

k

This can be generalised to copy tuples. We use Cji to denote copying j times a tuple with i elements. We ﬁrst show how to deﬁne C22 , then after encoding permutations we deﬁne Cji . C22 (x1 , x2 ) = h(C (C21 (x1 )), x2 )

Linear Recursive Functions

189

where h(x1 , x2 , x3 , x4 , 0) = (x1 , x2 , x3 , x4 ) h(x1 , x2 , x3 , x4 , S n) = C (h(x1 , x2 , x3 , x4 )) C (x1 , x2 ) putZero(x1 ) C (x1 , x2 , x3 , x4 )

= Id(putZero(x1 ), putZero(x2 )) = Id(x1 , 0) = Id(Id(x1 ), S(x2 ), Id(x3 ), S(x4 ))

Lemma 5. C22 (x1 , x2 ) = (x1 , x2 , x1 , x2 ). Proof. Using the deﬁnition, C22 (x1 , x2 ) = h((x1 , 0, x1 , 0), x2 ). The result follows by induction on x2 . Permutations. We now deﬁne the swapping function π(x, y) = (y, x), as follows: π(x, y) = E1 (E4 (C22 (x, y))) Permutations on any tuple can be obtained from composition of swappings and the identity. We will use π to denote permutation functions. Having deﬁned permutations, we deﬁne Cji as: Cji (x1 , . . . , xi ) = π(Cj1 (x1 ), . . . , Cj1 (xi )) where π(x1 , . . . , x1 , . . . , xi , . . . , xi ) = (x1 , . . . , xi , . . . , x1 , . . . , xi ). j

j

To simplify notation, we use C to denote Cji , when there is no ambiguity. Example 3. Using the erasing and copying functions, we can deﬁne multiplication as a linear primitive recursive function. mul(x, y) = Elast (mulg (0, x, y)) mulg (x1 , x2 , 0) = (x1 , x2 ) mulg (x1 , x2 , S n) = g(mulg (x1 , x2 , n)) where g(x1 , x2 ) = f (x1 , C(x2 )), and f (x1 , x2 , x3 ) = (add(x1 , x2 ), x3 ). Using these ideas we will deﬁne a systematic translation of primitive recursive deﬁnitions into linear primitive recursive functions.

4

From Linear Primitive to Primitive and Back

In this section we show that every primitive recursive function is linear primitive recursive. We also show that linear primitive recursive functions do not add any power to primitive recursive functions, i.e., the two classes coincide.

190

4.1

S. Alves et al.

Primitive Recursive Functions Are Linear Primitive Recursive

A summary of the encoding of primitive recursive functions using linear primitive recursive functions is given as follows: Primitive recursive Linear primitive recursive 0 and S 0 and S projections permutations + linear erasing composition linear composition + linear copying + linear erasing recursive scheme pure iteration + linear copying + linear erasing Projections. There are many alternative deﬁnitions of projections using linear primitive recursive functions, for instance: pr i (x1 , . . . , xn ) = Elast · · · Elast (xi , x1 , . . . , xi−1 , xi+1 , . . . , xn ) n−1

where (xi , x1 , . . . , xi−1 , xi+1 , . . . , xn ) = π(x1 , . . . , xn ). Lemma 6. For any (x1 , . . . , xn ): pr i (x1 , . . . , xn ) = xi . Proof. By induction on n. – Basis: pr 1 (x1 ) = x1 . – Induction: pr i (x1 , . . . , xn ) = Elast · · · Elast (xi , x1 , . . . , xi−1 , xi+1 , . . . , xn ) n−1

= Elast · · · Elast (xi , x1 , . . . , xi−1 , xi+1 , . . . , xn−1 ) = xi . n−2

Multiple projection can be deﬁned as follows: pr I (X) = Elast · · · Elast (X1 , X2 ) n−k

where I = {i1 , . . . , ik } ⊆ {1, . . . , n}, (xi1 , . . . , xik , X2 ) = π(X). Lemma 7. pr {i1 ,...,ik } (x1 , . . . , xn ) = (xi1 , . . . , xik ). Proof. By induction on n − k. – pr {1,...,n} (x1 , . . . , xn ) = (x1 , . . . , xn ). – Induction: pr {i1 ,...,ik } (x1 , . . . , xn ) = Elast · · · Elast (xi1 , . . . , xik , xj1 , . . . , xjn−k ) n−k

= Elast · · · Elast (xi1 , . . . , xik , xj1 , . . . , xjn−k−1 ) n−k−1

= (xi1 , . . . , xik ).

Linear Recursive Functions

191

Composition. We now deﬁne composition (see Deﬁnition 1), using linear primitive recursive functions. Let h(X) = f (g1 (X), . . . , gk (X)) where X = x1 , . . . , xn , and assume there are linear primitive recursive functions f L , and g1L , . . . , gkL such that f L (Y ) = f (Y ) giL (Z) = gi (Z), (1 ≤ i ≤ k). Then we deﬁne h using the linear composition scheme as follows: h(X) = fL (π(Ck (x1 ), . . . , Ck (xn ))), where fL (X ) = f L (g1L (X1 ), . . . , gkL (Xk )) and X = (X1 , . . . , Xk ) = (x1 , . . . , xn , . . . , x1 , . . . , xn ) = π(x1 , . . . , x1 , . . . , xn , . . . , xn ). X1

Xk

k

k

Primitive recursive scheme. We now deﬁne the primitive recursive scheme of Deﬁnition 1, using linear primitive recursive functions. Let f L and g L be such that for the auxiliary functions f and g in the primitive recursive scheme we have: = f (X) f L (X) g L (X, x, n) = g(X, x, n). We deﬁne hL in the following way: hL (X, n) = pr 1 (hg1 (f1 (C(X)), 0, n)), where f1 (X1 , X2 ) = (f L (X1 ), X2 ) f2 (X, x, n) = (X, x, n, X, n) = π(C(X), x, C(n)) g2 (X, x, n, X, n) = (g L (X, x, n), X, S n) = g2 (f2 (X, x, n)) (x, X, n) = π(X, x, n). g1 (x, X, n) Lemma 8. For any X, and number n, hg1 (f1 (C(X)), 0, n) = (h(X, n), X, n). Proof. By induction: hg1 (f1 (C(X)), 0, 0) = (f L (X), X, 0) = (h(X, 0), X, 0) and hg1 (f1 (C(X)), 0, Sn) = g1 (hg1 (f1 (C(X)), 0, n)) = g1 (h(X, n), X, n) = g2 (f2 (X, h(X, n), n)) = (g L (X, h(X, n), n), X, S n) = (h(X, S n), X, S n). Lemma 9. For any X, and number n: hL (X, n) = h(X, n). Proof. hL (X, n) = pr 1 (hg1 (f1 (C(X)), 0, n)) = pr 1 (h(X, n), X, n) = h(X, n). Example 4. The primitive recursive function mul deﬁned in Example 1, can be encoded as the following linear primitive recursive function: mulL (x1 , x2 ) = pr 1 (hg1 (f1 (C(x1 )), 0, x2 )) with f1 (x1 , x2 ) = (f L (x1 ), x2 ) g1 (x1 , x2 , x3 ) = g2 (f2 (x1 , x2 , x3 )) = π(C(x1 ), x2 , C(x3 )) = (x1 , x2 , x3 , x1 , x3 ) f2 (x1 , x2 , x3 ) g2 (x1 , x2 , x3 , x4 , x5 ) = (g L (x1 , x2 , x3 ), x4 , S x5 )

192

S. Alves et al.

Assuming g L to be the encoding of add(pr 1 (x1 , x2 , x3 ), pr 3 (x1 , x2 , x3 )) and f L (x) = E(x). Notice that a more simple encoding of this function is possible as was shown in Example 3. 4.2

Linear Primitive Recursive Functions Are Primitive Recursive

A summary of the encoding of linear primitive recursive functions using primitive recursive functions is given as follows: Linear primitive recursive Primitive recursive 0 and S 0 and S Id projection linear composition composition + projection pure iteration recursive scheme + projection Identity. This is just a trivial projection Id(x) = pr 11 (x). Linear composition. We now deﬁne linear composition, using primitive recursive functions. Let f P , and g1P , . . . , gkP be such that f P (X) = f (X) giP (Xi ) = gi (Xi ), (1 ≤ i ≤ k). and (X1 , . . . , Xk ) = π(X). Then we deﬁne linear composition as h(X) = f P (g1 (X), . . . , gk (X)) where gi (X) = giP (pr Ii (X)), with Ii = {i1 , . . . , im } ⊆ {1, . . . , n}, and if X = x1 , . . . , xn , then Xi = xji1 , . . . , xjim . Pure Iteration. Let g P be a primitive recursive function from Natk to Natl , such that for the auxiliary function g in the pure iteration scheme we h